Extracted

• • Target
    Santander confirming Aviso de pago EU876800 20221002.exe
  • Size 870KB
  • SHA256 babfc42e0af2245a67e8b245bdd1f5e11c840cae6e06ecbc6593ed62f4dd2175
  • MD5 d16791945e7c0d0949a095ce153103a8
  • SHA1 7aba679dc9184ce8e2b2861125675982dbbcb8f1
  • SHA512 5addedd5786f9c60a8461d3af853c71178a97cae512a8c8686c08a43b80c08a0189c2d11f0444559b22d2573a5080fb6bf3ea03edc2fe7269b5be62ffff03b07
  • SSDEEP 12288:CQbO/TGlCk4YQM9iwcXgrXwM10PQV0idSnV0xdsxh8FQLwDK4HTN:CwsTGgHYTEwMbM1xV0oDKhG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookjr22ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2