Extracted

• • Target
    order.exe
  • Size 353KB
  • SHA256 6574b76476fdc69ca469323d32b090f99f5ecddf6915daf13b812cbc77c15cf2
  • MD5 3a455d63a14fe5d2064baeac348d977b
  • SHA1 704ab6d404e72d2bbf603c276e50f75017126a6b
  • SHA512 5a7db6225d787945008c027ffa0477f80968fdd1ddcb39f04499daca510ada9215338de65dd0cb01e10a7b046c3ad6c9df73147d7303ca94a1724f8cbcffb7e5
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookm83ypersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2