Extracted

• • Target
    Ziraat Bankasi Swift Mesaji20221111.exe
  • Size 876KB
  • SHA256 aa7400a91906a2c688e83ea7fde82f284400e1aaa68dfaf87e6113768ec7f2b6
  • MD5 b7ca358976866b71d65857df55f52c6e
  • SHA1 8b3cf84378085d64be4acc7849cd1632a9079f38
  • SHA512 6966023bbddc2189e038334a53e4d4aebd79d6696e9c455c9a8e24ba4a346861463dfe97f1c3bbd96ee212b5147231eb0026a340cad70bbb143eb2ddbfae39a9
  • SSDEEP 12288:otqO+2YiZcyB7VjYqCpn0d/JWTZ8jjY8Y7C3gdWwdxM/+mxMuI2mtxXKJyLR+NOv:GS+BBtkp0VJWTZGU8YsgdWwdvJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookqmparatspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2