Extracted

• • Target
    HALKBANK E-EKSTRE.exe
  • Size 243KB
  • SHA256 bdb2cd093592b1e41acbf2e35565f0639628b86da36b1e6d49dcf1f81b751832
  • MD5 c8bb64ff80f537f1ae00443f65cb9338
  • SHA1 513f5a64ea483c539b180d6730396b1b86dbcdc1
  • SHA512 ac6e43b276e73ad3e505a1bae53a1365e4187894b167f404fefea57c1fceca0d8cbceae668bada9d92d91743d8d905ba34ed344eb011781c4db9aade53e22a9e
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookmh76ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2