Extracted

• • Target
    37b264ce06985329b256ea4a65512223.exe
  • Size 443KB
  • SHA256 53b1b0901a021e01a040e4ff3e81136781dce64bc9313e4480992fe8e9b2c8bb
  • MD5 37b264ce06985329b256ea4a65512223
  • SHA1 9c880bfa517f7926fec9dcff1b5128518795cd66
  • SHA512 e616543943c8dee78fae42614cbdd04342b99b1427ea13a8345e42bc900e18f4a66244e42984cac13a833fefa777f227323d443eea9f505c62a31b2247ce61fb
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratevasiontrojanspywarestealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2