Extracted

• • Target
    Ziraat Bankasi Swift Mesaji.exe
  • Size 638KB
  • SHA256 e4d96258c51cc4e4196c566e116077e7dc443a153e2ab651268ccd09c003d792
  • MD5 af4c1f1515a7e3156c5184ff9a3542f1
  • SHA1 ce0867236704c2e96dc85c4e71b57a3ba9000819
  • SHA512 c18536f2158e43e6376b17e4e1e714ae65441b5393a8db4cd2254b25ab7444f0910700ee4767162265bdfccfc40c24476ea3ecc57567cfe5f80c2311ace285ae
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookas31ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2