Extracted

• • Target
    Order list.exe
  • Size 625KB
  • SHA256 3c57ec7ea03791fee9e9c337171a74420550482bb9c1e626aeb7e183bcf4b195
  • MD5 912710b3bb7718ac26b03de4d790975c
  • SHA1 3d0aa71a52a470e7a9ec21ac0c5237f90a8e4fde
  • SHA512 dd487e0edeb8f2225265902726bab9968e9d3f130e926c2e5880b73b9f7f4e6fda4319777b4760f9965af6b172fe434e7eb07011ace518553a72ca2efb29324f
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookm18yratspywarestealertrojansuricata

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2