Extracted

• • Target

    Documento di bonifico bancario intesa Sanpaola EUR43750 20240223.exe

  • Size

    631KB

  • MD5

    76b483ad7da87a865424a75ec768e221

  • SHA1

    8dc85f0e5fc954165029e5eb97750771533910ae

  • SHA256

    f9c31e0238b8e6504435e2d5bce7da1896ffde15791d9189f933958ba690914d

  • SHA512

    9a4d55e0e9ad955620b70d01ff1aa5f753d47c053a9ae0058addba77c72b467dc632006e168b757dfc3774d2c91060cea85c1050b70cc2bc393f19c5fabee43a

  • SSDEEP

    12288:UjnCirsCB7yJT1gtU8EJYQaa1bFtsEKKVBCY8gXnUUEPzBh3:UjnCYsCaq28W7T1bPsiBCYZk/lB

  Score

  10^/10

  formbookpz08ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2