Extracted

• • Target
    Payment_4372889.exe
  • Size 735KB
  • SHA256 ee559d67bcad95fc4e1e6c867908b0b84338472a30d28d34da415c7efbd48f2b
  • MD5 d7e382bb4854061f9fc7a9806da0d7af
  • SHA1 07150c8377209b185e017d858f0cd6704ab2c732
  • SHA512 2f1ae72ebc57a8b312740425113240a0de56aab10c2248f31b7f66e452a30f2583e32bfaaaacf9f3f4ee692aef09196477075441d5be24ad6be7630137b22a25
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2