Extracted

• • Target

    20f07f9db62afe07a6a3b025487624ef260d2a2ef5043417986e5334556e517b

  • Size

    426KB

  • MD5

    cb783c9daff07c32ea86f1bbf2a32aa7

  • SHA1

    67695f79d67dad3068b33216cdc1492b66d7602a

  • SHA256

    20f07f9db62afe07a6a3b025487624ef260d2a2ef5043417986e5334556e517b

  • SHA512

    4c33ef083ea76477fc55873ff55f5d8fbcb0634d21787be6afcc024f8f69f96b201974a77ed88c6ccb5a2b8d70521b9da9bf25d402e26f3ada421e5253109346

  Score

  10^/10

  formbookshratspywarestealertrojanpersistencesuricata

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2