Extracted

• • Target
    8d4a4c48639dc2ea5557ab5b8004b479.exe
  • Size 241KB
  • SHA256 cc7308b7f5cd8fdd0916e83b1463f989c3aa03ef2516c6f2a24db3ebe62a41f3
  • MD5 8d4a4c48639dc2ea5557ab5b8004b479
  • SHA1 35e4de534de576b02ca9e1fea5bcbba917213465
  • SHA512 ab35e82638b2032e9ce4149a82d39025b7d03af6006307eabbe3fe7ef10836d4c8d0047b510a2ab290e27806f38c0b2664a19cc69e770b31034a850671aa89e2
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooki1a6ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2