Extracted

• • Target

    Payment-Advice.exe

  • Size

    2.6MB

  • MD5

    3e416710f120b91849b1878d07ecacd0

  • SHA1

    71eb6640520773803b0201cf4466ff57cb3ac81f

  • SHA256

    a56fd898ced9c080955b0ee12f4d652bd1b74ddde43470e94033a288e2b97dfc

  • SHA512

    3dd24bbff081711efb22f9c4b056e820fbbb45722ef911c7b9bf68b91ed436b2f16af95d2970b29c1d77858f922b4e91b8f2d61856d06d31731de983a796b451

  • SSDEEP

    49152:l0LiB3F6szZwltsrSKYsbCNICNfoAgQflqB:l3F62ZwDqSsbODNfoAgqK

  Score

  10^/10

  formbookpurecryptergunedownloaderloaderratspywarestealertrojan

  • Detect PureCrypter injector

    loader

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2