Extracted

• • Target
    DHL SHIPMENT NOTIFICATION 284748395PD.exe
  • Size 768KB
  • SHA256 3859da72cd34fc9b4ebe2ff100a3d888845836f4945bf2bcdfb83d5d0d16508a
  • MD5 8945b3088d32b7df27ea9b23550d6fe5
  • SHA1 955f6560aad00d7d72dcc6e4b2cdfe3e12983c3d
  • SHA512 6bb3a1ac9a81ce2c8ffd4782dd1eecf786cc0c4c73ffec674e3f8d277986d242fceefcc7f2e1ccba81d4c33473923edd368df435615c49cdf02db95aa41094bd
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookamdfratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2