Extracted

• • Target
    Ziraat Bankasi Swift Mesaji.exe
  • Size 691KB
  • SHA256 b38804166eadbfa83edfbbb26115a35bc284af64a8e3429c3011a13965fdcbf2
  • MD5 82e5f8445f104069e52ac321d6deb453
  • SHA1 ea88106784cdd3de5f936242760c04a00ff90760
  • SHA512 7495a30e490294124cb8adb58ca27cba56d4fd9b9289d8717cb59e3c51827844908c03c9c17fd82d7a4cfea530c7b21419bc5811fe299cb82f986ee7a1902338
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookpr28ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2