Extracted

• • Target

    eb29c382d8a70b5d78802d04ec5623e4_JaffaCakes118

  • Size

    989KB

  • MD5

    eb29c382d8a70b5d78802d04ec5623e4

  • SHA1

    0e74128bb6f4c5a75596cfe87a6df9e09f35d1b8

  • SHA256

    28c5ed49a415babc182c3c990ec24e5a860fe7b51b0fc768cccae59a08f8a26f

  • SHA512

    498f2b08468ef18cbb10a070cce05969f84ccfbe800eea1523e5bae37dba5a8d2fde515cc16bb47187311f779b1a84964940f4d8b0cbf8aeb95aa54bec7fede3

  • SSDEEP

    24576:Mtb20pkaCqT5TBWgNQ7aIkX04z6ZQrhk6A:1Vg5tQ7aIktzCQC5

  Score

  10^/10

  formbookwardiscoveryratspywarestealertrojancredential_accesspersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2