Extracted

• • Target
    Untitled attachment 00075.exe
  • Size 938KB
  • SHA256 a4bf92333fa0839d92c30859f87f08f91f988c35dd30227c2b4fe60e7188a4a2
  • MD5 8cad21a8377f81f6647fac069ff6222d
  • SHA1 c06845f662d64492d4c4df1a6c506d20bebda40d
  • SHA512 e6373bc79be0361d0fe60456a466f620d476e706770ebd15fc17ca3ee28b7b12d09eb70e3caf5ea3db8d4b778822e6830fc9ffe0c1d3e90fa6e01f4438c95a12
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookn7akpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2