Extracted

• • Target

    de380d6e306a565da0abb6c3c3a1218c_JaffaCakes118

  • Size

    1.5MB

  • MD5

    de380d6e306a565da0abb6c3c3a1218c

  • SHA1

    e23d9b94520ee782849891946698093c0bf5548a

  • SHA256

    ff620f29513c7adf425b7689392a0f419258e6607ba99be0c710760806d1dcd1

  • SHA512

    9aff49d5c86a5b5cd37b90a2489fc6b77c89abc2b8df55ba1fb2e86a6b69e8f3a11b11c7c0a267f6d333a3680338055adb0a3e6053e94e8b84c6cb5000176c00

  • SSDEEP

    12288:RpLJ5xYSHm8SVu/aQofMgWgfpLc2kn3pvihfSDWEQ7lPQ6H+Uy1Susr8MmH3jR:mS9ScaQgWgR4339SeWEgloZZS5R0

  Score

  10^/10

  formbookupiodiscoveryevasionexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2