Extracted

• • Target
    listed goods.exe
  • Size 721KB
  • SHA256 cab5f50e805b3a36e0ea6cf84c40b4b90e372fcd2f3f1024664af5440282d496
  • MD5 91afb771acd23304827f4dca829e360d
  • SHA1 99f14b23168805c8860a21de598c95f8e28cd75b
  • SHA512 686eec9ade39a4cdc638d56259911c8908b115f826f6eb0516f91289dfe64994b0418f72827d55cd59872bb73f1abc0e2c1e347bff5bd47f217be0905f31a42d
  • MD5 SHA1 SHA512

  Score

  10^/10

  modiloadertrojanformbooksu4hpersistenceratspywarestealersuricata

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Formbook Payload

    rat

  • ModiLoader First Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2