Extracted

• • Target
    BOQ and MEP WORKS.exe
  • Size 241KB
  • SHA256 995ed5a87efc98cfc45cd810d470bb7aa28a8e598da4a27516892bffdc99ac27
  • MD5 bc6a5aee704817d8a6deba0f9e32d89d
  • SHA1 3589441b7ecc285ff578d390fffdac2f53b139b9
  • SHA512 ab21fb8907496f56453d818e2ef20da0d97e899b78a99f8b638442031c69aa8a4751fd35b9157c499093463a07242903d35590685c71b787508f2f2b32030be8
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookdn19ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2