Extracted

• • Target
    PO-0087HY.exe
  • Size 560KB
  • SHA256 c60e862dbc8789d65606a8aadcdc4472d6db35d37be95c3e02fcbb92ba64b30f
  • MD5 1a39af28e5b80bdcef27425cf352633e
  • SHA1 57906511a85bea0612ebb42e4d5bba5122368998
  • SHA512 b33a517c92dc5744d7e0dabfb35d7536054354a25931a2a861f1c1a3d1d94c49cd506e1d1c7aafbb0414b95aaad4770c864043f2289958d1f03b498be3183f98
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookdw4gratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2