Extracted

• • Target
    PO 240046647.exe
  • Size 391KB
  • SHA256 ff4e7b32b4c4ac0f5fbdd12b9c2ffd894fe647d1d22fe009035cc307a540322d
  • MD5 f12fe68dadc0c9c8243bb5bc53f80952
  • SHA1 6c868fe841068fc887c795478aec1c2ac939254d
  • SHA512 17a0f2cbdf82262ac7b7371ff7e3a16a3611031f89f2e006db7da28cf1a3d20a7542291d11d199c26c53b9939ad8682b129197e5a1beee5768e75861cee533fe
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookamdfratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2