Extracted

• • Target

    Purchase order PO045793 from Voile Trading Co.,Ltd.exe

  • Size

    320KB

  • MD5

    b02fb2439cd88a5e399683f14d6d80ff

  • SHA1

    7098d5175626c3bef989a7d0e0344158a752ebc4

  • SHA256

    c6bed06259f7c50c2b15e8161d5b1fa11690e69a7e5bb3261202debfb7d96708

  • SHA512

    aff2394e671e8f8b33d7bf5a4444590fb53c74a2f6bc29faf3627a467652f0d2d7f1bd22c420bd46621638ff2849c30be265b71ecce89b14f83a4d68b6cf78ba

  Score

  10^/10

  formbookmw9persistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2