Extracted

• • Target

    ca264140a1f253e55e891d883a7dbf74_JaffaCakes118

  • Size

    592KB

  • MD5

    ca264140a1f253e55e891d883a7dbf74

  • SHA1

    e6ab69e4269ddfe19da3b1c57c974969ce2e0030

  • SHA256

    52e78449928063d1d867d0023a1e4aa7f211cf631538724411eb54f4b08fc411

  • SHA512

    0c6349873736284cd7839ad32fdac93d04b341d81f649596aed2f4d22e756f8a24bcaa9e991a77fd1901e7a0c3445c5407b7795adf09cc8a1d63768ebfdf5dab

  • SSDEEP

    6144:aVZMpuFhHs1b7Np49aSbeXg3OebAfFlG0jUv7qtpBm/m3w0+yoyoMGGGGGGGGGG5:SZM8FhH4b7N6auPbuGurmuVHKHjl

  Score

  10^/10

  formbookhx291discoverypersistenceratspywarestealertrojancredential_access

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2