Extracted

• • Target

    9433bad28e2f5b93f26ef692353bf1fbb7f51bddb3e3780446893c10b9f8f6f3

  • Size

    999KB

  • MD5

    102a8198e3fb713f3cf3f77a1f0c4040

  • SHA1

    41465c7ebb50e1202354974841f0c542733b1d98

  • SHA256

    9433bad28e2f5b93f26ef692353bf1fbb7f51bddb3e3780446893c10b9f8f6f3

  • SHA512

    571322371df8ee0c21c118e314ffd8299c049f7616870acc6d30ae4bcbb85a7f312d85b1db6cc89fb9b11e1fc20873809ea19b72b5cb3b05bcbc1d86c158c566

  • SSDEEP

    24576:pBhEA9CBESBU1rvEQP7XaDRngG+sjzX7vG0Mh+dgUhuiiz:DhEAMBTBU1zEQra6G+2e0k+LhuR

  Score

  10^/10

  formbookc5u0discoveryevasionexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2