Extracted

• • Target

    New order.exe

  • Size

    281KB

  • MD5

    44d67d39cf033d2b1c5f669e181456dd

  • SHA1

    93fa54a9399eafe1faf0810fc6f7d4c1daa77ee7

  • SHA256

    7292b78a638622778908fde4d5ff1f66b4d2ed905a0f36622b28da645e0f0faf

  • SHA512

    d549df5a78f54f51ac601263a2b61c69ef328a6cb2619244b1428b0ec46895722c7c89f8541820d03e943a0a6d39b89552c830ea156b08413ad4192c4d995d21

  Score

  10^/10

  formbook8utrpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2