Extracted

• • Target

    t9w7eLEE781llAk.exe

  • Size

    1.3MB

  • MD5

    3903301e617641ad7609ca7e09b4bb80

  • SHA1

    2544df38e978f6aaf53ca5ccbb4078befa745351

  • SHA256

    83f231a4e196b10089d16db819c71bfc5cc543fb55ea5ea63aee2d1285ff3dc3

  • SHA512

    fcb598ae444827eb6bdac4567ffcb1b18af792f6d4d19e9b788543994ab5b53529c5df21d45681ec45cd76f49477fa1f789a0db0ad73f00ba6e75272af912851

  • SSDEEP

    24576:B7YXNa2kita4HBIb6kFgaGvVNfZM58gN8GdvwPJORyyIwU6XOHtEga:hQa2kit4GksxMOPuvwIKX2Oyga

  Score

  10^/10

  formbookrujediscoveryevasionexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2