Extracted

• • Target

    PL PI.exe

  • Size

    483KB

  • MD5

    a55080b594286b0ccaf24ea05141293d

  • SHA1

    1b7076439313bd90da6d37263a297fb613efc82a

  • SHA256

    0707523c23666b0535673287616ea82b34e810594ddf19c45a0746d1bd697070

  • SHA512

    fbf9b42a524985ca74de35338b0968bc54bae7b5b5693927e8a33d0be3175486966e863fcb1b98433d31ad3186cbdc80799e648e82f2a37c7f81a2a62e4445e1

  Score

  10^/10

  formbookwusevasionpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2