Extracted

• • Target
    DHL_AWB_NO#907853880911.exe
  • Size 213KB
  • SHA256 e0586f6e028448a0dafda2bf958fd9d1d9b63636b29c8a8847e481a3122e71a2
  • MD5 fb67faae4d6130eb562c38fc510dfeae
  • SHA1 1dde4f5576327e33d629a7ef382c149613f188b2
  • SHA512 0aa32ce0ea540febe6bc3387235ec52fd5c7a8b4850f831aae0069acc9ea81455dfc422f61faba693782e6e5c899c0386aba0918f2c435fb43a0ef178c022502
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookfw02ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2