Extracted

• • Target

    8702b3a38be01053d035b1ac848dc09b_JaffaCakes118

  • Size

    465KB

  • MD5

    8702b3a38be01053d035b1ac848dc09b

  • SHA1

    a6bee8f41ff1b27612bfb5b124a5c26f140cda8a

  • SHA256

    b4797a0d1fe9fb6f6e293174113163d715e9e3e3ceed1456cce8108f803bff86

  • SHA512

    bdb3e0171888acf5f3ce968104e66e5b566e153e29688dc1b7d3e4b987f197482c85a78342eb0490d2d56a40c0e9d6c1b8b1e95667c85377f8611824142db0cf

  • SSDEEP

    12288:zn88KwqqRDU8hXgutMMT6Bq1SSkEc3+b0Zd48XG1W:z8lmgkMOaYY4sG

  Score

  10^/10

  formbookh328discoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2