Extracted

• • Target
    e6cab1dc546c3d3af04305b97992d36b_JaffaCakes118
  • Size 477KB
  • SHA256 d6817307408c704dd71dc68edeb870d25c6773078bbd9c3fb522f476c755da3b
  • MD5 e6cab1dc546c3d3af04305b97992d36b
  • SHA1 318eeb841cd33bde5b6e5e50c1e8a2b21bd209ab
  • SHA512 f3848263ab8b8a90a1c6af1b9af41a25a1e4629cb091c7cf9aa2574a2de22b71f60c2077a0366810cab578baeec26a56ccc4566fabebf53fcede134c2e5ec5ab
  • SSDEEP 6144:5JzKf/zmCja4qQmQCrcbnFuuUcTFx0T21BOcCSaa1MSSB6T1KpQcHCbhp:5JY1ja4qQ+rcbFudkuN/S/1MSSPQcHKP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookfrpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2