Extracted

• • Target
    Request for quotation.exe
  • Size 544KB
  • SHA256 afebe2a58337e50acfaadf900888c90195c2e50127b281d04aa3d799474ca43b
  • MD5 55e2d9b44406e28892ac92ccfb7b9168
  • SHA1 019a8dfd2883884a943c30c29380a147eff96461
  • SHA512 1f7ff98f0aebcb8c6a7bdec47adad7e23a25f4552b662d117d58b299de9102a0f2286a0c579bd7f3527f18bc109293c0dfaaaec186e045bec366b9eda5efc90c
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookir93ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2