Extracted

• • Target

    PO 0094899101.exe

  • Size

    762KB

  • MD5

    4c274f3bc91970597ea119c632c45860

  • SHA1

    43fda1bfe6971a37106d9827433b07dae500fe30

  • SHA256

    3c1db94995f50f8d469f8d44278a9fe97864afca4be64ce6aceabdcbe9d91de8

  • SHA512

    bf9eec01cc9fe9e5b4ce24f10cfdf059bcc2d0a11ea8d3ea82aa8dbde5d1c4aa715a171dcec6786461d1f4dc6af9f396ad6dd6add188a111a5f972dd4dd8815e

  • SSDEEP

    12288:YbIg+dWn45FiQxDCDTkEwYlaPU5vot96i0KeDC2/2ak6NqpIESRaJ2:YbZQtaQKlsU6tYiEC2FkMUSRaJ2

  Score

  10^/10

  formbookelhbratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2