Extracted

• • Target
    POgMmI.exe
  • Size 1.3MB
  • SHA256 4f11e57e682eba91e574e673edce45efab46c20ad2d98826fb1b0880adee2aa0
  • MD5 8415b1d35c8dad9cf2630d7a4a9c8107
  • SHA1 6ce3a8619d93859b173cfb7c2d52d45601df12c1
  • SHA512 98f37a401255310311a83d3a2b7e12b991458fb73a8b80404d168ac5dec07f50c8fda92afcc65f091b6b821f50f41995bec2a51eb7974f33592afb033e03af65
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2