Extracted

• • Target
    HSBC Payment Advice.exe
  • Size 1.2MB
  • SHA256 e6d6f7cf5ab4892455617b818579f8123d6f32eb13adb93c4feca7c6caa352ff
  • MD5 92b20d7d42d45550e6bb3d941525cd32
  • SHA1 0fd373e31fb5487b5dc1f45b522a937f4f33ec6d
  • SHA512 298eb91086d09b88cbab048f0d4acda47c27662174385b27b9e31add4a94e8873fe4cfd1097a1cd62b217e83ac1300580fa5da437108168339bd10f249915aa1
  • SSDEEP 24576:l04rZBwuc2Sk8cllBPV28ElzWzW6/KtzUkfzbfk:llrHwuJvRa8hn/K/Dk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryformbookphy3ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2