Extracted

• • Target

    PAYMENT FOR PT1098.exe

  • Size

    807KB

  • MD5

    e78a007b4a9befa903f31bc219bcbd75

  • SHA1

    c8f9c31c70aa6a20dc7e20a909e23c2672af9014

  • SHA256

    5bb96d0e0036475868552414f3645cd7bd779629f1c9ffdbb5da32af26fd641f

  • SHA512

    65fd00bf0bfc4a13bef52a98beff89c68859d0fe21477476932ef9a2841f2ba5a3acf69f1ef5766eee2277a8b8cacf36f745c0555c11358bd2c680b68e47259b

  • SSDEEP

    24576:Wr18+L74mBfNUstzo38/JY7xki2xTq1r3r8JN:WrO8/JYlDI

  Score

  10^/10

  formbook06ehratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2