Extracted

Extracted

• • Target

    a67c13ca70d60247253b6b329bcea0c0_JaffaCakes118

  • Size

    1.2MB

  • MD5

    a67c13ca70d60247253b6b329bcea0c0

  • SHA1

    eee58ee3fbc96b248b9b156df162187c8ef73fcf

  • SHA256

    1d7b28dda54ec1a9b7003d01cd37bb495feccde98355945ae0370e51e6fa0f74

  • SHA512

    3bdc1b93d02a9fcdcd1a75989149f084c6bbf616f97c723016d6477a1cb75aa6c75796024ee4dd534ad1f54c4647d4d42991324c99fd0f759f33a591707d59a8

  • SSDEEP

    24576:8fc5/XLJWXJyM5wvzMJ6Rbdg8QyxQ2vHYV:8AdJPzi6HgFi8

  Score

  10^/10

  formbooklokibothx314collectionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2