Extracted

• • Target

    Payment transfer.exe

  • Size

    317KB

  • MD5

    96106d8d331a6f9c135c1f81bb82d9fe

  • SHA1

    7e59ba122d299460504be159a862faeaf2f80491

  • SHA256

    293f8c9b635a869a00e4f0d275c8a3e8f358242e4813e443282cbc5ceb8f099d

  • SHA512

    87309e2ed58c1d5b257a73abb1332c0faf36c98972840487b2388d7dd96ed1805d06bcafd831f36c980b1fd1283ff54636f885eaa9e4797fb7d19387144af4d3

  Score

  10^/10

  formbookrmjevasionpersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Adds policy Run key to start application

    persistence

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2