Extracted

• • Target

    3d7030426830af1ce3e9e06412954688_JaffaCakes118

  • Size

    223KB

  • MD5

    3d7030426830af1ce3e9e06412954688

  • SHA1

    a664885f5f911b3add94b379c7caa8729ca253d0

  • SHA256

    a409bcf88a07c401c4f6f11be261c80b47c2e5ae29338c7ad5de509ff1eefbd8

  • SHA512

    9506362a98b64e17d9b8d00347821933e7711fff12cb4d2d5b79041fba58f10551db9f1c9088d8cd051170fcfb6f5de9631c0aa5a76ff5a15c0c3aaab8e782d8

  • SSDEEP

    6144:UDk3eLcIxMtD67ASSK9xIQF+0jBbFy/Mni+iNHBrCaHl5:x3efMZ6cY9mZuBbFpn1iNHdH

  Score

  10^/10

  formbookgoratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2