Extracted

• • Target

    c49b28723e072ebf59a5917c1390e502_JaffaCakes118

  • Size

    325KB

  • MD5

    c49b28723e072ebf59a5917c1390e502

  • SHA1

    fc5c7975c2ae71ce95d2e2ad132539cc5a67353f

  • SHA256

    d21e26aa5cfaeae40be681b6ef282698d6e3b76dea7f6f1c54233870aca8ac8c

  • SHA512

    405c55f8ad898a612372634d9ec1c0ee08cd505f4eb3724894f4b9cb0a9459dfc77937b82cabad072ce019d66f11b59e6f90ab19ff4749306e16834ce2f1b930

  • SSDEEP

    6144:3IDk2llfQ8FZK7jfp6E8Ty3YUEXznI6mh9X8EL3HR8yptp7Nu+:3IDk2Xf0fpnHYhy3XFHR8Ap7Nu

  Score

  10^/10

  discoveryformbookhx63persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2