Extracted

• • Target
    Banka odeme havale makbuzu 20240213 TL950000900.exe
  • Size 609KB
  • SHA256 c083f7c60e94af315273100d14faf674572f5ea0ac49e80d2b5b0a7e5c33347e
  • MD5 616233f799a4325a5a7fb863c58b6549
  • SHA1 5dec21eb451b8f0455a0eba9bd044f674e90e8e4
  • SHA512 adbfa26bc9babce88212ed9dca84c662e84ee4e78947dc37cc71bd5d2ddaaaa5acd237c52ad200004779636b4e1099f9d64530e0a6eec00dfb400c4f62129807
  • SSDEEP 12288:wGQWeQ5vziSCfyJjIm1/DAhfQdS4bxF57CSTyptmQYJTzduOkACHItygzmYlxL:rriffyjp8hfESaRC6a8J/dp0HIUAmYf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookpz08ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2