Extracted

• • Target
    RMTT Documentation-REF GZARX019-10-22.exe
  • Size 338KB
  • SHA256 bb596a4d943381a7c56efa450df660f6707d317b806d715eac72a62100ea9832
  • MD5 2555262098b6620edf2bb59e99e89e74
  • SHA1 6fea25aae0553ccc207373e39529b9cd0998ed31
  • SHA512 4b3b481474cd4cdbd68a19e1ca3f5f1a90050e9eb2b06caf563b7fbff150f3ddda0b512a47ce14c015edcab80dde141c8d117a534ef435f1e84d45aeadf343ff
  • SSDEEP 6144:8VGdx6x1/oup0OhaxhA5HW5Z2vsmyrunaqhexSHgGzA49BLkywwLxlkwJI9uJG0:wnAkYy8cyeakdAI3Qxwll5I9uf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookpfgcdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2