Extracted

• • Target
    Banka odeme havalesi bilgileri TL9850900 20222510.exe
  • Size 601KB
  • SHA256 a14a7402e2a08d44585f37122f323cfbfd13f2e5d36377242e60dba60a348610
  • MD5 e578e2395348ef698ed40505373d8f31
  • SHA1 1c146342c0017bce48894a047aece9d4dcf88721
  • SHA512 ed029d8564469c851deecc2740e8569dc291abb7a54fd51e8adc6eed8be7811964db7903f2adf7c7941b46d60e6e1c55e30cfe1ca306814e0abdb3a83468836e
  • SSDEEP 12288:E7/vy1EbysqY8H9bz9Mdx57TPkrNSab5827Q8PpbpCM4cO67yIKNtg7A84:gyYVqY8dv9M97TPMMab5188PplE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookjr22ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2