Extracted

• • Target

    ORDER_29741.exe

  • Size

    395KB

  • MD5

    b9c6aad2753d835eefeeae486fac18ba

  • SHA1

    f2744185e692cedec652edb07b8a174c34e9f327

  • SHA256

    e3f68e3679fc2ab587e712ce137e107318ebaa6bd5e724a76200bb10c945312b

  • SHA512

    1856ee344f1fecd55dc7823f0eb6c1999bd65a244da100b1fbf0550c9a7188c099854bf664f192a71b578a8ce5342854e1934fb2b8522082bc9412b23751fb1d

  Score

  10^/10

  formbook20wpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2