Extracted

• • Target
    Transaccions DOC-REF DX739475.exe
  • Size 335KB
  • SHA256 b689885667b1f8a29bafedff5fc69526534732ebb7731d98bbc06f7005b245d5
  • MD5 82fdb6200333049bef2def43678680c0
  • SHA1 ec44d212bc9bb9e5efba361a12479db455a34eb5
  • SHA512 4fa55e6f743240e7077b3e4a765d03b5630a6bdad6cc7c29331c0686e5b2c5cb9c4fbd4df1961ca9744bb54eead21dd9d0b5193841f165ce407bacdfe19a61a0
  • SSDEEP 6144:kVGdx6x1TWYMNOGYDlbpBHMtEWDqrunaqhexSHgGzA49BLkywwLxlkwJIfG:4nFMNOG87lu/DqeakdAI3Qxwll5Ie
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookgbwwdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2