Extracted

• • Target

    a4593dc48b36c06b904343de10634104_JaffaCakes118

  • Size

    415KB

  • MD5

    a4593dc48b36c06b904343de10634104

  • SHA1

    eb45d290dc0a0d163f3d61caa9c56b018184d7b0

  • SHA256

    fee33ec6f4b7e470ca76c30a2bafc8a8b8041ae2806086f7ce9d51c072d50518

  • SHA512

    7001be6361b4db0bf250269259301ce626550b972d05bd9b72a2d472cb0cb28b75249d8f5d50fc2d854becfc1a905a0473bc1ea631bc0e17673c0435891676c7

  • SSDEEP

    6144:yVn8Y/2+3x5spUN1yY0zyZfrPfiUE+a/5Uvx9F2VfPKeY6:y58WhWmNEYOyBa3+a/5UJ9s

  Score

  10^/10

  discoverypersistenceformbooklsoratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2