Extracted

• • Target
    DEKONT.exe
  • Size 476KB
  • SHA256 67edbb99d3aba4abdd5edb3151171935ac1ceb730fd3227da79c33e3b2ab03c9
  • MD5 e7a8d39e151309312608bad3d0ef0cce
  • SHA1 03e609c5ab541538067e7a8d84d9a5a43c553603
  • SHA512 5ef3313a22bd34393fafc04d6af6507c316a9668c34a4506f6ad7f0be7697235d84259e05d0c30dab705198d804e64cabebcda323645888494076c6ae6d9819a
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookg3t1ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2