Extracted

• • Target
    Purchase Order.exe
  • Size 628KB
  • SHA256 3f6c93773e47afcf964b6d01313d63b90dcdb8ac227cd7bb80b232fc924f5aac
  • MD5 8a5e881fbd6f1560596a80deee399380
  • SHA1 bfd1349731e0b54884741b6a17c462142fa9578c
  • SHA512 fa46068b11595583089e8532827c6d8233c19ae0ed814c12f8c43ecb242315da3f9f7104b3d0096b053bb161bf6c7da4e23b4662983b40d7a349222f13fb6ceb
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookir93ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2