Extracted

• • Target
    svchost.exe
  • Size 992KB
  • SHA256 df8f7e81b9ccea1324a19fd1356c8fb79ea5623ba4095195f86c29f3816b5f7f
  • MD5 ed427d483fedf9e80f4a3cbba7638b06
  • SHA1 c550587aa6a773bffdc8310a5575d2c8ed482b74
  • SHA512 30aa60737aec1d06396c0b9627a8e00506fa9e616aa9f9eedc197208962c4b92151515abeed487d9551631fad8cea5a39c82da4123e929f2fc993763b75a6223
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2