Extracted

Extracted

• • Target

    tmp

  • Size

    88KB

  • MD5

    eebdd5b69b2fbe296a4e848b6ece83e7

  • SHA1

    a416b80860c5810aa92c72382eb34c29a36ad34a

  • SHA256

    dfb9a75bd82bcf0d9f72647affdf954d936d629eb3be78fe4b5c9b5166ccb9d6

  • SHA512

    b3d4a1cde995d12e16367fd0437a0fcd2bf52081aba40eace547e79838d17de40bb5162112132d3d1c49f7baf9a4c1581a8c4f696df64b4321c6f7cd27245afa

  • SSDEEP

    1536:LgBV6YZ3juIBFXJpk+CfZxtLOgiC2fjYYYYYYfpQpQpQpPd49N7H:UBV6KTBBFXJpk+CfZHLO1zfzpQpQpQp+

  Score

  10^/10

  formbookpurecrypterar73downloaderloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2