Extracted

Extracted

• • Target

    tmp

  • Size

    989KB

  • MD5

    8fdeb9288ce47576a8607e2e58ab41e6

  • SHA1

    e0c3f9a45831d582f4aedee7390334a1fae5a059

  • SHA256

    a9ed1381e07210fbb362eecb1ccd3bb75464bd7f63374c88521d8395fd660ed8

  • SHA512

    6e2c48d104662a69fe19f990ccc2dd79f4fde941c323ebcfcb1e1dd57a172afb9c25f98d963a29df6953be9846bf7589dde55b81145d64961f0c5ee19f1f529d

  • SSDEEP

    12288:YNvpX+P31dxk8ihCwhuJ9zps7vT2DPC7VLRpelCwT5SoXDDgKTaPubII:yONdxk15uJLs7vycAlrT5ZXvgmh

  Score

  10^/10

  formbookxloaderncprevasionloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2