Extracted

• • Target
    e022df111f1fd982758accff5c4e23de.exe
  • Size 1.3MB
  • SHA256 80d6f86936cc5e0190138c00ef2a03b2ec8abc19a1b2a7a0b3683e864f4fa982
  • MD5 e022df111f1fd982758accff5c4e23de
  • SHA1 0db154e8803c16af52e4bfcb84252e28e2a9c631
  • SHA512 ecb379c24342cf0226a6ace4223d166470f5041c7f6966410685a8a054ed5fc8a62c4aa5912111ea90d089ee3847e34eac0e9fbc6a42eee6778bdb10a6ad426e
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2