Extracted

• • Target

    a3d145e3c72db7ea3e18a306410a0445222a8ce83235794dc404dd470843caf2

  • Size

    771KB

  • MD5

    061af339cbf1835f53f9b84ff1c49c21

  • SHA1

    7da36c353e199e2c097233653d48b26ae3de0c43

  • SHA256

    a3d145e3c72db7ea3e18a306410a0445222a8ce83235794dc404dd470843caf2

  • SHA512

    ba657afd8c62539d93f696fcc0a2c0ea4315f5172592cdddbf9aae9f686d8193bad5a6419fd50d08df5fdb537f9ebaf3a5f61261f822b67f76695d0bf2dd9f42

  • SSDEEP

    12288:4X3bbJTSjkURroDEor+HXtqbL2cikjfCYV:k3RInyysbL2cr

  Score

  10^/10

  formbooko27jdiscoveryevasionexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2