Extracted

• • Target
    rDHLFacturaElec.exe
  • Size 680KB
  • SHA256 047ff870ac53c586bf0def7e35cc07b312e25c8e75f0989ef5ff7729d42c193c
  • MD5 e6ff3ff07c56108635b0168948101a83
  • SHA1 1f9f8e18dc10ff09944ff40dd96c9f1ccfa87532
  • SHA512 eb8b29e923dd308cd9bcb4f5fdd4677dccfe3f355f8f1b2e0f2d1bf4989065944933cfea0419dcc154ed33d387a84ca314f88bf8d34e80aa9f11da41e3945487
  • SSDEEP 12288:W2nIX5Ujd53LlvWZNQwRmazU00aq6XnRYQMkJ2OaV7O/wTPAovPnWnN09jB:W2ngKY/ZRp7RSKoTIuWnNCj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookpz08ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2