Extracted

• • Target
    obi.exe
  • Size 423KB
  • SHA256 95c30ee77cf4d9e39a29a1dff147a9154b0dd7a6499b9deae1537d3ecabf4774
  • MD5 4fc8947cc4de2a9c5f09c5c78155881b
  • SHA1 cc92312afbbe2057cf663036993462261e468301
  • SHA512 73da869237a64d5c024af6d957c184c8c82b95d3f5dd0c56c8383d2eda0c8d87fbd2ccd131c4231b5436873e61c5ac0ee88f4bb5bebfc5e5071c24216723d09e
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooko20aratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2