Extracted

• • Target
    444d3df9a20c68281353a091f76428e3_JaffaCakes118
  • Size 485KB
  • SHA256 c222b07df99688f8ba5c35ce475d970b9fd0597420061d42707b553d00c788aa
  • MD5 444d3df9a20c68281353a091f76428e3
  • SHA1 b8659dab04ea1120bc696a1ee43b5d3022f830a5
  • SHA512 34556cf1a8ef045f8ae76f5d81216cae4748f51d3ecf81a12e2799c7ee4705457e47c5755c26bb40f296a27e7ad088c703d899bab8472f409b9b28b83ee6f1d7
  • SSDEEP 12288:IJzuW1RElKHFrTzh4NnsGvyrTOEEF1TQEULvz/:czuyElmlTMshrTC/kEULvD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookumagilenetratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2