Extracted

• • Target
    Justificante de transferencia ES080049 EUR57904 221010.exe
  • Size 1008KB
  • SHA256 49790af2d4dbcb19d9467b8c3fffc208ec92eb4368bb2e98102699ec28501667
  • MD5 1e6cc3b26ddc025154f2cf3dd79cb6c1
  • SHA1 94d8c6bb92a52e745135c32a7556515c2b9836b5
  • SHA512 2c03da86b606fa23156f2a9ac8d83fed9aac01f94c0d5a011a09e651c6f167d425561adde9df0ea49a82707fb49f453908b6f7357adcf79336e6f4d9523bfa05
  • SSDEEP 12288:eHuhdxfe2iNvv7x9j0w5t7uVeiCr4flUDOTGrQp7FK3bUsNUNI8F/Gu:jhDfe1z9j0wb7uVeioAKrB2NI8E
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookjr22ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2