Extracted

• • Target

    2d660b816d3e2c96db56d5d2e6743b8e649c63dda5e46327b5dbffdceab1d499

  • Size

    724KB

  • MD5

    139f804af6727f40136efc05b3810f07

  • SHA1

    4e91c652e3fc8efaf060f39d2a31ae09b1b57090

  • SHA256

    2d660b816d3e2c96db56d5d2e6743b8e649c63dda5e46327b5dbffdceab1d499

  • SHA512

    cc037549c0e1dcde4ed7109709e9450a9370538fb1be3fdef03557e758209520c35b3ddefe61b7fdd8a1358a848ec9797ef8326f656c97ff880cdec37428f04f

  • SSDEEP

    6144:Jo3K9Dnnyx65H+MfjJN5M/lqLuyRkXBymUQOuRH6vDdpQ2T7BxzaJK+Go6Uq2A:JocqGJaJ7BzUQOuR0RpQKExGZUi

  Score

  10^/10

  formbookhs3hdiscoveryevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2