Extracted

• • Target
    dekont.exe
  • Size 234KB
  • SHA256 c767db1d9bb5f369f3a2d395412c98f71de29cf829800a2494a2c0dec8e4a57f
  • MD5 1704cbbf55f8851401b3e3797a0ec152
  • SHA1 10b1e8f12b6e29b4212496cd78c7e0df508baad9
  • SHA512 375ff1a2044e6ceac45f17078b7bc859c03c3f3914a1ffde37a236357fdf609d30baddab8d86cfffcb23ebaa42f6f3b7013518fcf71b6b79805f7b6905ed10f2
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookmh76ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2