Extracted

• • Target

    Copia de transferencia bancaria.exe

  • Size

    971KB

  • MD5

    8ee464229bdaac78e1354a7ff334af85

  • SHA1

    a566511090198f92b82e07c1675b256f6c91e923

  • SHA256

    8095979c4153bbcced38a6ee12589fbb67f356535a91cf22e26413ee3f1c4e34

  • SHA512

    836274df2b83188718400c22b71becbf445d2f128cdfbc342cb62cb3655cc70441a638705911c449f500748e7be13082a11ac4d261a03e9c805cdf10e3e1ab87

  • SSDEEP

    12288:Ntcg0r9tDZddpnLnv2hVSKRytHxnrceHMcrIaPy1FTAUI4kSxv1/:Nt893hSh0K0pxVIaPy1FW41

  Score

  10^/10

  formbookde19discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2