Extracted

• • Target

    43e5b4d8f0e6ce3e201c1e829556ebd9f1a67806296180ed29dcdbf387afd19d

  • Size

    639KB

  • MD5

    a8a83c5be8fac24c516269133b54356b

  • SHA1

    93f4b8f93bf8e1e4fa25e28c9f26e5043f915486

  • SHA256

    43e5b4d8f0e6ce3e201c1e829556ebd9f1a67806296180ed29dcdbf387afd19d

  • SHA512

    9615c3bfc64449a62a2492c935d5750c44f4d136013ba7cef407989d42c65749a7258b1f78d132c928e1e1a0b2863d0d34e9ba598be799e8f3ce82607cbb55ca

  Score

  10^/10

  formbookh35persistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2