Extracted

• • Target

    Santander confirming Aviso de pago 204563170sanlccjavap0003.exe

  • Size

    1.0MB

  • MD5

    e5642a38bb30edfbcbe6a6310a957947

  • SHA1

    ccaaf390759ed34d4ac19845c3ec7b36d9c71596

  • SHA256

    fae26e4e053e961e5915ce5c4f61fc17ef33ca7252b0bfeb253cd3f15a2014cd

  • SHA512

    8981e5e999a41a01237bea5715df1180995438851d1838ea8d76ce02b38b9ab3933b5f60c16750437e0bf420bf6b4dbdb73a5cbace48b12a4a97c0825b42d737

  • SSDEEP

    24576:kqqo1m20WeUUidksW25gr4sgoSZMKLdba7AuuzXdLd+Epw:kqZg2ZjgVBwdWMNzf+Epw

  Score

  10^/10

  discoveryexecutionformbookjr22ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2