Extracted

• • Target

    3f332ec29d9e058eb1c0e296b04b2518_JaffaCakes118

  • Size

    867KB

  • MD5

    3f332ec29d9e058eb1c0e296b04b2518

  • SHA1

    aa4d9429a1f410beb085f86fa4a5f516f99f6a8b

  • SHA256

    df8b0772860e56938078f92e437d4c04ff34808f40837e249b85af1ffb4dee4b

  • SHA512

    87037bf33969bded6e7e245dfe28edb3f2f1b57ea56b7071957157c2c16fbf4005a68dc198b336c751e346931e479a12f5dc1878b583e4e227a47d93d0700c79

  • SSDEEP

    12288:RupVlyZLmQFafwiXjsDB2ZRgQtuyXnEs0YLEjK101Z/jit2NjFxOH+l:RuHWLlFcwkefdtyLE3DjiMNje

  Score

  10^/10

  formbookm3ucdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2