Extracted

• • Target
    Purchase Order.exe
  • Size 645KB
  • SHA256 0bf294fa8036aaa1c481756b521a5d30093b7bb588b0b8842456bf9d3443ea1f
  • MD5 e801d071e8274eebc86328b45c5d1e80
  • SHA1 b768ca125a05ade5b56db6beed6678a33e8fe99e
  • SHA512 cc39ae145361afb55ca03ef313f7062f1180fe1458bdc12a73dc5f43a6722acffa37cc32257ef8f28e22f7466aea9f9b060294491d4d71d1404b0a00d181ead4
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookir93ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2