Extracted

• • Target
    ekstre.exe
  • Size 235KB
  • SHA256 472fce69055da6dee0ab8f9bfc0fd3979a766aec390cd6bd5bb01483e27cdce5
  • MD5 080aa3660cba5bdd3a80c87755f7c6ab
  • SHA1 3cfc6a93df82a0d9ef24594cce5ae956ea9016de
  • SHA512 835b9b26787b30a997d28006aa7b24c3f68c78cc39ac8222311037f4af381f8ffed436c20a47a863dfc662e15246191295037e29c64be5aba102a165f2a130be
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookd23nratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2