Extracted

• • Target
    Justificante de transferencia ES070049# EU17800 20221013.exe
  • Size 894KB
  • SHA256 c2a2e935606e9b8d5ffc48c3fe91812e29f8abf0de31abfd6eb4d014fe781e5a
  • MD5 35be61ec5cdff4760f7127e2c99771a2
  • SHA1 586031db5316f348ef004d927553790a6318514a
  • SHA512 d0f779d404835d2fc9d592d98b7ad905565baeaa025344094b602c7aef1ae80e4d0840acfdd381348d16a38ce08c546986ff5dea36a9e37d756a7784320e1b03
  • SSDEEP 12288:K723iQYEKb7eBGtREWJmbJGMBfdVTVMPgDsq0R7lz8bs/xU:KiSrbaqRt8bJJB1VTVkgIZJlf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookjr22ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2