Extracted

• • Target

    f9c3e48053b1596692a1da4f093f5f28_JaffaCakes118

  • Size

    821KB

  • MD5

    f9c3e48053b1596692a1da4f093f5f28

  • SHA1

    557d5354944cd24b117371aab5e2267ac02d5599

  • SHA256

    516a9ebf1f5231682f10b7569f11c281074435e8b925a9ddeec6c9bd9e88a914

  • SHA512

    be8e4ba4f89071253af52993772a8263ab2ef3b7a2a8106b871fa477987b9bd505bbab99e9874c46e0a5bac04af8901743a7a8decb65984fd24bcd5d7c4ea3ed

  • SSDEEP

    24576:f2O/GlJGT9fH9jJPhXA/wmxhKbH3rUO46GVw:DT9/9jxhQ/wmxUT3idw

  Score

  10^/10

  formbooklediscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2