Extracted

• • Target
    0e6d87f5bd5e0fc8d8ecd6949623ef02.exe
  • Size 1.1MB
  • SHA256 2fd6b2288864f3a099a32bd923f7b3c67db00c979aa2e46db125e104618e92b7
  • MD5 0e6d87f5bd5e0fc8d8ecd6949623ef02
  • SHA1 4df7241a27077b6bbd8cc69efb103edb8d46cf92
  • SHA512 8c7ab60be0fd184090c473c9759c253d054d343bf271d9ea04444e8219f82fdf63668a2d9d6d5a3851320f9624ed5087e51c30cd547f2b4ded65fed85dc57ee8
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2