Extracted

• • Target

    ceb305646f9a8229ff55bf26432eb527_JaffaCakes118

  • Size

    532KB

  • MD5

    ceb305646f9a8229ff55bf26432eb527

  • SHA1

    247ff878939c7ca96db9715afc03e5032c143909

  • SHA256

    e9eee1a0652b7aeb0e816ad27e45d791d5d2e576d7f57833f0de46bc1c651a0e

  • SHA512

    c7bd25a68c8344b2315ab3bcd7ba6741cdd93cad3a63274c6a65f727ed5ea5e11bae10db1e88b9e3687cc08736488c3d47375a11514dd5e541cb26e048fab4d3

  • SSDEEP

    6144:QES4fnuEgmu4ZVKgCV7PKgJSbMw2D7PIDAtVsEHoALjYKmFe3l/H9m7u:QErfng6VKgCV7PKQUSD7w2CvKmelk

  Score

  10^/10

  formbooklediscoverypersistenceprivilege_escalationratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2