Extracted

• • Target

    0535aac19775700bc13586181c92a0f4ad31d4b9f2a8a9488e025a55aa09cf1e

  • Size

    652KB

  • MD5

    661cdc0eabc36a6513bdcbfab2229d91

  • SHA1

    68dfc27daa2275ec7174fecd05a445f80edf033d

  • SHA256

    0535aac19775700bc13586181c92a0f4ad31d4b9f2a8a9488e025a55aa09cf1e

  • SHA512

    01e203bf11614e41eb97c7a6cd9ad2343f02b4178b2cd0df979b1731de334ec013007fcda3effd5aa205641a9b3f4cd5e3338d24aca4d1999d8935a4d3a2f942

  • SSDEEP

    12288:fGnjjX/mAWN1qJFTPUQIHu3kJF8jxYNZ8v9dNIE/Sc:faLa1qkJFf69LIX

  Score

  10^/10

  formbookhs3hdiscoveryevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2