Extracted

• • Target
    invoice dhl.delivery document and original invoice sign.exe
  • Size 439KB
  • SHA256 5fef546d71e9ed9f2e457bfd9aeb23a42a5074af37599c7fe4dcfeb8f687723c
  • MD5 ebce26da75669d94dbc0550bf394b204
  • SHA1 bcc8f769e51cd9f8a160e58840f80a008e2b72e2
  • SHA512 0e87adccb6d3ca4ea2ee2e101a20ea81437e3f774dd3296c264c92ce763adacacbe1a8a4b9b6226c0b8403569c716fd5fcc55820ea4a0575172d396bae432ed0
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbook9gr5ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2