Extracted

• • Target

    cc38e3ac1ca97aefdaf92643c1dc68f3_JaffaCakes118

  • Size

    414KB

  • MD5

    cc38e3ac1ca97aefdaf92643c1dc68f3

  • SHA1

    3f80d544c9e3b789db490a13c86dc5cd61682bc2

  • SHA256

    22542d1aef8c0987be0f91b90e4f70f372cc1b16ed67bbb1582798cac732f538

  • SHA512

    04c876e75e495e1dad18c06d669c2965feaa25d454fa54dc754091effc67c4704a78c10a53185b0cdb4e2cc3b5ca9ab6854632205539e6853dbd84e1b4f79235

  • SSDEEP

    6144:w31JnqbGb0cd0yGdXeEW58hp9b5vwMVO5UWoU8F0:w3Hqb3meXe0loWkUl

  Score

  10^/10

  discoverypersistenceformbookpgratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2