Extracted

• • Target
    1TOFpZKvqyRVuuy.exe
  • Size 302KB
  • SHA256 b43bca6dcc03b6c289b15fd6dde4bde2dee13d024f08b0ca47efefc9d9aa3d8c
  • MD5 4a15e3620504681438565df947f5a702
  • SHA1 750e4c022b615a9cc9ff4a8ebb3091e66244815f
  • SHA512 60d107c9a2d75c899919a69f55020ca60053ce164a8a796af78202fa1b56127c595d7b846da36c22da16390e1f0d51fdfca7902e8d7e25b3735115c16f4472e4
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2