Extracted

• • Target

    Ziraat Bankasi Swift Mesaji_pdf.exe

  • Size

    360KB

  • MD5

    129fc428eedcc54b06becf3c5cda4e72

  • SHA1

    a312b86be1d712ce3ba5156327e273dc47f48959

  • SHA256

    89e2a77118c2c57d2eb0c1e92a3aa305b759529e38a6879b42b2e2f15a76843c

  • SHA512

    22a92a6ad8eadb98fcbec57cfda3860cee0e2911da926d5b82b04867a76cac3b9be5f916126313079d08bfdf383b898289db920359f628a26e4b06d55603354a

  • SSDEEP

    6144:NT5UzmMBom8YX6xf85dhVD6DVM5RDo7Q8Df/AaORv/g45hpWDkUv5ZHIAim8HaX:NT5j3mgZ6hVz9OQ8DgHfpOkUv5ZHIZ9F

  Score

  10^/10

  formbookguloadermi94discoverydownloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Deletes itself

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2