Extracted

• • Target
    9326cb1f30e786f29ca93604a290116d
  • Size 997KB
  • SHA256 e073516efee850dda1e008bcd82c3160cb867dda001bec42d76f6aa6af82a257
  • MD5 9326cb1f30e786f29ca93604a290116d
  • SHA1 42f8ecfc26abb6db5946b2f8d8d663b8cc71ad0e
  • SHA512 a174d23b8b56bd81f3b0656b37cf1eb7491672e2cc40bfabc9292521c401749df47445dee62731f9aea43e2c3c6945e78cbd99669bd3512b50ef7d58945bd7c9
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookgh6cevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2