Extracted

• • Target

    f7ad3b59548788a59172b6477a1b83f0_JaffaCakes118

  • Size

    571KB

  • MD5

    f7ad3b59548788a59172b6477a1b83f0

  • SHA1

    3b042b49ac135f38824de3665a051a7631e98782

  • SHA256

    f22a0b5b12687ae12b9f4d625d82a16562bce5e1b03b7d7372df3813e5afc8e5

  • SHA512

    039ea0297abbf3200d145790f0fccc0e4ae8ddb6e2eb75021781c4c131494398602d4f80f65d4878c419e0c35a0368acc17d626affec868ac04c69687d2db341

  • SSDEEP

    12288:ECGb2I5hQeMda6UYZoqNh+8LzxdYlBxg/pngR7:tGbVxMWqVNtvxdYPxgg

  Score

  10^/10

  formbookdfcdiscoveryratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2