Extracted

• • Target
    Banka odeme havalesi bilgileri TL9850900 25102022.exe
  • Size 604KB
  • SHA256 e8db90d8d2528f0767e5b82262223e07578e29f8e4166df3cf495318006ebbd6
  • MD5 cbeb5d79b343da7407ddf20eb16cab2d
  • SHA1 cab43dfa06a24434415c60b54960c39968e06840
  • SHA512 6e57312cf6692083ccf12cd96dfb0bcd3a9ed711e261b8200c2a26a00abef705110b1009e4c3973af6bb350ce00d953b856d5939f8f1b3be3e80a978b0899367
  • SSDEEP 12288:QbDdKnYh3fN/NarGcqR1AO+7l5yed3PpBwVXp/69oaFFchQxAvQzzRI1mxdnSv:QbDcYhPNFaCcu1AOS5yedfpiXt7u+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookjr22ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2