Extracted

• • Target
    PAYMENT BANK DETAILS.exe
  • Size 880KB
  • SHA256 a9c993b79501ed32742c5ccfd04e3c47d75fd26795fd87bb3dfc288384de7be3
  • MD5 8afcd5967a89c4c97b8ae703eb0981db
  • SHA1 19bb83bf63073ebd0b1edb9eee13c0beea44ee8d
  • SHA512 681de677ba9ef507cc4952e0e491607f3bc9d337fd5299dc566f5c10fb5c457cda1c3359f49a65104cc84f9c10c329d99e28281369d58e0d10394599bfd374d2
  • SSDEEP 12288:G5huCiSx98vxj+ULGjrQkr6wNz0cTjMQ1QfD8686upcY7l:GDQ5UcwoOjMh8V3pcol
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookm82ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2