Extracted

• • Target
    QUOTATION FOR PR24849983_docx.exe
  • Size 592KB
  • SHA256 05aed53e8423caa4f5e47b2a77e58a1a882e42c03fa9f99cd88ce07d8da3aea2
  • MD5 f23e89543e8627182579f68c5916fd05
  • SHA1 418a672527adf6a337e98a6cc235d30d00066d48
  • SHA512 eafa756d3c36b2121403764652e9e6dfb3e9c04b188802e68ffba1506846e3cc24631431a15bbf9af6b176f3c16f195436949fd9d516290de2117fdf9fcab5b3
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookamdfratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2