Extracted

• • Target
    Justificante de transferencia ES080049 EUR57904 220710.exe
  • Size 937KB
  • SHA256 d51e64e598f57356d2e7f0ab76723cc0d1efef0c6ed396d29efa50a229a82a4d
  • MD5 1c6cae2dded6d6d7202dba2cca2ec9f4
  • SHA1 a239eb97f8a866a07ab889cdbc75eb0e1db81fc1
  • SHA512 e6c896c51ddd82cce78c5381d96837eeec6da168d8dce5bea354632c224f4289c5ff49e8c4149d4c6cf729bab12cf7cf71de872418b2194b60533eb0efb93d3c
  • SSDEEP 12288:iHk0A2iNfJ2uOttmaw9C05tNxu7w5CEoRsgjin2V3V6/r4lfXq5Zdx6Z5:p1eZ7mv9Xa7w5CJRsg+2V34r4ha5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookjr22ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2