Extracted

• • Target
    INVOICE NO 6573.exe
  • Size 686KB
  • SHA256 7e0c1f10cfd225b16e83ecf7bc37a782441b8a96225fff827572bc3a81421bb9
  • MD5 bee8617ab417c9ca36a3d25908634b2a
  • SHA1 ab689684feeb34417fc19807b9777acf0f0f489e
  • SHA512 a69bbbdac33ade0fa26d234a3fc314f815f1395ee3d0b95ed7df6638766256815b3688f374a6f9ea8c5c814cb58e626bd2a1a632883ee908e210c2eb6c68a1c0
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2