Extracted

• • Target

    c8fda80e652d365bc5ceb4e065c51ee3_JaffaCakes118

  • Size

    958KB

  • MD5

    c8fda80e652d365bc5ceb4e065c51ee3

  • SHA1

    c3e984e1e8a7421c17e3ecd3a4e3a4ba183ae562

  • SHA256

    4b8ad4a9d84c014358222a91b7a8d3b7f6b3a5853750d84e1d1e677a5bc9e9ff

  • SHA512

    edf9e0ca4d76dfe023a309e68ad06d25e960f6173b07d132908914a165f6f32b12280c0d400f86637594f3d28317170cfce134d0154346a4a6376a27acb9c50a

  • SSDEEP

    12288:d/UQS1E+wSE1vfy2dJzOP9vExIH0h1zCShca7Av7Q292QOdGHRp69:dewSWfySzOPux0keSG62Dxz69

  Score

  10^/10

  formbookcadiscoveryratspywarestealertrojancredential_accesspersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2