Extracted

• • Target

    cbbd0d914f1b8fd1852e514a77ae16c5_JaffaCakes118

  • Size

    614KB

  • MD5

    cbbd0d914f1b8fd1852e514a77ae16c5

  • SHA1

    cdcfe3f05d2334b387d9347ad7dd0f7806e497f1

  • SHA256

    31c8c2014f2c7d1425741342ba9cc283641764c189e7e18c0caf571728d931c4

  • SHA512

    d38e0dff68899ec64b1f9b77fd4d57f3b5231e36fc79e2303468089b5011eac3969df4aab9fd18240b1dd0f12091f384eb270539a205edc60a31319e2f2626aa

  • SSDEEP

    12288:51beMP9g/CigiRVZzV1NTY9JNSE++JhIQUaPQWdoC4E40fAgyJ:516qCCsLZzV1C9JlJhJJ4Odf6

  Score

  10^/10

  formbookejcredential_accessdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2