Extracted

• • Target
    Ziraat Bankasi Swift Mesaji.exe
  • Size 457KB
  • SHA256 7f64aa4801b0cbae5fdda52ae4fe848ef03650a4dec91b4f4d5131a0def6b464
  • MD5 bfd5416efae1ecc1517f4b286c30b655
  • SHA1 6debd272160fe05b0c3397f612f1c8e7d005f376
  • SHA512 4e29a8d547abaed04837a4e02a0b47b5b8d1a8fc435eadcb8115b5b4d3464c5239aef5a25becfb995a0f3da2536bce798bcf944d422a7211d2aef3725e8ff7c4
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookpr28ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2