Extracted

• • Target
    Justificante de transferencia ES080049 EUR57904 221010.exe
  • Size 1009KB
  • SHA256 49bee43f1928c8c6cf9c0d2d692df4581235784d51ded3051685fd18a51d5599
  • MD5 5cc24a82bbdaab6f009d121f24fff1cc
  • SHA1 c43cc47611c09cc6504c6079b2b15d250f8d17ea
  • SHA512 c236ef4a7925959248366132af212b7785fd239d584e968b781174ca7f5a91881c5626a7147bedab3962ee833497b412656016aa51d06b76d245de643b92b6f9
  • SSDEEP 12288:8I1daQlg2iNSv+LwDAbn250bdzpBi7jYEFiyPHDmTthqtxypR7RAAu:di4g1VzqAlPi3YEFl7ConyzRB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookjr22ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2