Extracted

• • Target

    Purchase Order 77809 for acknowledgment.exe

  • Size

    281KB

  • MD5

    48884ebe9169015be3e42f68ad14d7be

  • SHA1

    4c0fe63fe5090ed8ac71f3af10dfc84c9b8b0f5e

  • SHA256

    b36d0b4952457c89f455f2333a815b0a1d7530a108bf43ea0ef1a7c17fe2774b

  • SHA512

    9258362c161b710264767cb180913c3190c6594961d40d1fdc976babfeeb4494aab31678cc9eb75662bf48e1055c8d62de0c8c9d2f4061e3917afb325c6bc0b4

  Score

  10^/10

  formbooky22persistenceratrezer0spywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Formbook Payload

    rat

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2