Extracted

• • Target
    PO022159 -(signed 220425).exe
  • Size 891KB
  • SHA256 e677af4720b0b6402c8b677265968541dfa6b57f12578f7701ac840bd1f0889f
  • MD5 cce0f752c08f2d4d57a336bcd7451ae0
  • SHA1 c96d6d2b664f7718cf83d2d1b8b79acd892bac07
  • SHA512 c4af0903626be161d6e9b914a6111aa1883fedf5035652570d862f2369067a798bdd92f71351c6e08de1d2f11480a1fa1a50fa66b5e118d2e9117dccef0fb937
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookamdfratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2