Extracted

• • Target
    Quote Order #103888864.exe
  • Size 496KB
  • SHA256 6bb732e1c22295b2fa6970a286225d14bd7c6fabef714f9b20c3a622bb8e7645
  • MD5 b023fa82d376a7f471a8e2adbd9fdc40
  • SHA1 c78f365db800f5c3f1d16c5b6c63160fc5675967
  • SHA512 5fc1cad2ded34052b44e910945c07f5ad93626c988703320688d44e4527ec24ecbfeff9f9dc077db865077ce4f80a36eca8df40ffc81b9315d1f786fab0750a5
  • MD5 SHA1 SHA512

  Score

  10^/10

  rattrojanspywarestealerformbookevasion

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2