Extracted

• • Target
    QUOTE_8392.exe
  • Size 559KB
  • SHA256 87945ecb2a81ea654a98c72800f03a4202873f30f58212cdec3d6d577be04d4d
  • MD5 84c61a7293e34986b51bbe02160005a1
  • SHA1 7e790f1f9250c78afed30f1ab29f75269938dadf
  • SHA512 3d70d27b7e5bc4b641cfde96c845ac9f319e2dd3d92a6b139de43ae5df103f5fd5efa135b37f4245a69a09ad3b2fe2599d6a5fa72c83489f53464cf1a5d6e04f
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookky13ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2