Extracted

• • Target
    Ziraat Bankasi Swift Mesaji.exe
  • Size 661KB
  • SHA256 d640fe3968dbefc28ce7ae480b3e01578c6a1232087d7d17f96fbe35d89c19ae
  • MD5 701c1f49568f70851d15750742a6169a
  • SHA1 b1b4256b1c91b916220039c3c803316ac818779b
  • SHA512 8fe5d361ea9fb42f70f8a02d4fc6c5ba044328db3d1421cdac6489dbff3159d10ab6fb580630ff641a70bcce63e00da2fb8c2b10c616c3c5ea343001b6d9701f
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookah6mratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2