Extracted

• • Target
    126ad6f0d2a59c907e9a72e06f5f3cb3.exe
  • Size 461KB
  • SHA256 0db8c615e9cd13c0bdd7b3bc5b1b58bc0e27574d7ba4577f8d4b30a8d8b4337a
  • MD5 126ad6f0d2a59c907e9a72e06f5f3cb3
  • SHA1 f23d6ef649396005beb3c2f403c833c2d7d9c5a0
  • SHA512 fe67a6b179fc1f3ccc5ad615bfac82040d5b8664832c1e6cfc780226ae18236886b48acb4b4830acb1a2cadfa78f2252c0160828b261bd8107e37cc0851ae276
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratevasiontrojanspywarestealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2