Extracted

• • Target
    jaffacakes118_Trojan-Spy.Win32.Noon.ilw.1a9c00b931b7d5fad786afcbb9a5809f
  • Size 268KB
  • SHA256 cb92f56f089353460fbd35575473ce6f9f546540f8da13cff59c7851cea43ed3
  • MD5 1a9c00b931b7d5fad786afcbb9a5809f
  • SHA1 3b4b68bff5d1bc0fb26cde28e7a15a9538f238c0
  • SHA512 335a8763355c0d76c0de3e8c2a0d0d22bd409e495b0462798a0879a73166772109ef529ad3e6c1e373d282d96cf08857df6e6c4bd8ecb1b7be8313d0d310e196
  • SSDEEP 6144:q775Qt/NOnxt5hg6jIUnzA8hSk/0OOQfymBOLtfCKwVN:q7tQtKg6jIUn8Ed/VjfymwLtaKe
  • TLSH
    T11C44029EF687C56DCA3E0430837170C4AA77918736249D2E62FC472D7EA1E4FC25BA19
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  d7defense_evasiondiscoveryformbookpersistenceprivilege_escalationratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2