Extracted

• • Target

    PAYMENT COPY.exe

  • Size

    1.0MB

  • MD5

    40b8041f55f40b2975deb791cdd40f17

  • SHA1

    c0a57f918bbdd09d69e2fb380ccea7cc69e65ba8

  • SHA256

    9a5edc79c2643926c35c6e83248b6c196c5cd081f74b3b689ae9f02be6b18369

  • SHA512

    f3f0cbb4bd3515caeaad79f99e050445e02a6678ecc679206dca1c7b701785fd65086e10e7eedf4ed55a3196f8a2995961b92a7ae1bcab93bf71b11f2ac4f995

  • SSDEEP

    24576:iqJo1MNiwGovlW0G4lA0PsUCiyfTwWQn:iqiKlbfPbCiy7w

  Score

  10^/10

  formbookuymoratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2