Extracted

• • Target

    0CT2020PI.exe

  • Size

    449KB

  • MD5

    0323276cec08509c8e789d02a72e91f6

  • SHA1

    42e777f48b451e11bdc6a94966402318c30e1e18

  • SHA256

    42e9c8cb3f59920b9ba876d6ada4d7a23c4feea3bfd5d93e6758da2ab1d470c5

  • SHA512

    6e2d59de9016ef9e37ae76d1d94091c95a0b523c113d3b346b523ec788b4d0c596130c4ba76cab1729e50302cb25845d47be7d76b033c39b1b88f5bda3f25b0d

  • SSDEEP

    6144:SqoZ0sHMGbBUkuetgzBgj8XG4p4Ir8ZOCfdaDe2ji7qK1GPxL1+zfZCpPnpmwuFs:SqoOT94IrQ5dFWif1GpL4UaSZNL

  Score

  10^/10

  formbookwt6discoveryevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Windows security modification

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2