Extracted

• • Target

    bc0d9c5250c435e2b08aad396db5fbea_JaffaCakes118

  • Size

    381KB

  • MD5

    bc0d9c5250c435e2b08aad396db5fbea

  • SHA1

    8ef94d5400b6d10fa683ca6bad7efd19ef2282c3

  • SHA256

    267cdbd24ba0c232c80967c7c39f454db0e59b6943836750a5cfbaf2540768d8

  • SHA512

    70f75fa30063fdd3b0452e4d0b2936d27de2bfa3c7c5430bb96e532229211ffab167dcf32cfb552463c075b12f01427132c207f530026df710cd4e72174c6269

  • SSDEEP

    6144:bDsrpmOp5fjFopppppppp4a5pppppppppppppppppppppppppppppppppppppppQ:bDsdRBGpppppppp/ppppppppppppppp

  Score

  10^/10

  formbookmidiscoveryratspywarestealertrojancredential_accesspersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2