Extracted

• • Target
    SecuriteInfo.com.Generic.mg.ed742e269ef67357.14342
  • Size 488KB
  • SHA256 6b3c0907618cdc1bdcb07dd987ee91dbcc691b2181d947e81d8d2756d7cea195
  • MD5 ed742e269ef67357977141e71a985327
  • SHA1 10994d3ca60d587165d43446c236efaa00c9adb0
  • SHA512 13ef27c97bd88c48d826e3f310e04ab75cd1b169f35d4dc779c9365bc953e64346d0faf7c6c1bf845462deeb9f7f93513fe1b2f4f6af4f5fa4fdb8b7d0e15285
  • MD5 SHA1 SHA512

  Score

  10^/10

  rattrojanspywarestealerformbookevasion

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2