Extracted

• • Target
    e6c7bf7335f458b6ac9b782a2f0e1cce_JaffaCakes118
  • Size 711KB
  • SHA256 b294802f853ed8a103a4aa4a13ba03007e8fdf7dc4c54a72415ecb1fce013d1b
  • MD5 e6c7bf7335f458b6ac9b782a2f0e1cce
  • SHA1 b9bd1cc81e483bd5c1569cc4235ddce2c3a37e9b
  • SHA512 069ae8bb92345a604619d7a76e3de37eeb919f7b691a9c75d514012a63556ee2a6686bd69699376c26835cc2e3947c5d13b3929b4673704476c1848ece74f9c0
  • SSDEEP 12288:K/jPU9PPU9KxOGU0sWc5OsBgo0q4wMhx0CWDQC6JwGpinwpihHGG9AuGO3lx/rXE:K/Ic5OsBgo0q4wM7qYwVwpiQG9fTx/bz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookte82ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2