Extracted

• • Target
    M.V TBN - SHIP PARTICULARS.exe
  • Size 858KB
  • SHA256 e99dc54786d789c023b028074e4fa0858d1cf59a04d7fd2f33319a24dfd7a978
  • MD5 cd7e12d4757c0a1e3c0284f5a8c43858
  • SHA1 fec1a7533d63f771b6c30266e5acdce0143f25c4
  • SHA512 ccd0049cd5fe22fc22e84101f70d6c93f4d464347a8336be7760dd7e3e842da46f44c972905ce2d7abde5065325b59ef3304221450f9cd592410ad8dd4559007
  • SSDEEP 12288:gR/4veDHABim3vlPGBcdewKmsogluHJ2Rt/:q4veId9PGGDFgwHJ2R
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookermrevasionpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2