Extracted

• • Target

    eeb694061828a85d96dad172e2c0d769_JaffaCakes118

  • Size

    800KB

  • MD5

    eeb694061828a85d96dad172e2c0d769

  • SHA1

    86cd45c03f37da755031827664db75008871d531

  • SHA256

    86449943dfbb8187f96e59372009d7f31981becb12e676f86122945d72ac1d58

  • SHA512

    09921461c533592abfc2f9a07831b106a17bdf34840a5f9eb5d2ab5bf44e50112c04c0e304d9b1838dd5531b579584d0ac43c158db3d48667f42a546d772ccdd

  • SSDEEP

    12288:rxkgb+yDaWrRhRXtbaJC82qrVHF/ZzO3qbkbBIM5l9tWL/PGLkB:rDDhrRhRXtbrq14PbBIMf9tC2Lk

  Score

  10^/10

  formbookhx200credential_accessdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2