Extracted

• • Target

    eAdvice.bin

  • Size

    803KB

  • MD5

    374dfcd12791782c9f84b3dd72c47029

  • SHA1

    5462c5daac3985aea3e1dff59f055183a62d9065

  • SHA256

    89743e19eb7f977dab3591eda342ac51cead1a15829028a151359e845c10a255

  • SHA512

    813de7f1e6fb3bfbcdb40d09bef3161882356f9a786e53206ed17d6e12cd2b5f2615ec619d1de850b994b857285971f03dfc59282b81e5a53eed7fed8db25186

  • SSDEEP

    24576:7azjP6+z+2fNzDFnGNsveawUNXit980Ipulg:+XNFnFnGNsvvli980I

  Score

  10^/10

  formbookhx303discoveryevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2