Extracted

• • Target
    06ab8c9ec1bfcbf7da7f34b7b0a74d15
  • Size 459KB
  • SHA256 f09288cc78739d3ea28dec0e501c7aa01cf695b0d642f56b7edddf09b42867e3
  • MD5 06ab8c9ec1bfcbf7da7f34b7b0a74d15
  • SHA1 7271cfebd8ce632b932c3a4e83b024db69b99289
  • SHA512 e375c8be27da16d41adb81e78dfdedf5652339695a2f111a46cfc5393dfef358285101a30238f927f05387a2d4761262251aca12bb936884d10c890a3a0b00b4
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookx2btevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2