Extracted

• • Target

    PIsept2020.bin

  • Size

    714KB

  • MD5

    7f63c36771bdf84fdcb80b1b6a8ce300

  • SHA1

    7e027829b30e9795006725712c5666f3ff54bdbe

  • SHA256

    cba7797f53633aeb00ed0c8418ee90e28b7fe7bc4e787521eef333ff6a67c627

  • SHA512

    198cabbf51817d47165c318b3308701ccce4b04ce88712d7984deeda2c52b4baf7bf75758d77a3ceba3c5e22689a8ced13c78322fa2d6a7f950f0bd966f2129f

  • SSDEEP

    12288:EsyixjQfJkrWEm0Zux8Y8nMdByNjolspgZRZu48Jcx0Ksz5XxM4Sh:EsyIjfo0Q6NnasNjoe2vf9x0Ko5Srh

  Score

  10^/10

  formbookwt6discoveryevasionratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2