Extracted

• • Target
    e-dekont.exe
  • Size 248KB
  • SHA256 fb958fde2068ea3f3cb5df440bd6f8cac47afef36ab98024153138ca9a982a5e
  • MD5 9c6a564e4c3d13de0be965e0ea24b858
  • SHA1 9e023997162f522a30969603039c47c9b5229b0b
  • SHA512 b4647a1a9344187f93d0b034401067b900ebc75b2abb077af010e91736fbd95b91109a3dc66215cff4d5b850989b91ab6fc46d65cc5d450d40ca17c26248f56f
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookmh76ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2