Extracted

• • Target
    RFQ-22-03795.exe
  • Size 773KB
  • SHA256 81a32d1f1e2cdaad0988595ceef9af6fb40e7f2f7d08d7794a4fa7e1b09d37e8
  • MD5 30b4fc49dd45819a236f6f572166b411
  • SHA1 887b2458dd8b71333cdae2f0bb2f41090f2e4aea
  • SHA512 2779ffedf512770700eab0848d31813c1087ebff6cf2f45774e865610807dfb9cc8f5d6dac32ee85f3d32a7d91c21e40b0686e1f280b72c95e564dbb26803afb
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookamdfratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2