Extracted

• • Target
    jaffacakes118_Trojan-Spy.Win32.Noon.jez.e46e481bf6113db691d8ff20fe359512
  • Size 496KB
  • SHA256 547b2707ac55036184036a2fd60705261a14d3c7ba8af2eab86874bb168aebd9
  • MD5 e46e481bf6113db691d8ff20fe359512
  • SHA1 c8752703b1c9cb718b2577204cbdaa227a3e0d76
  • SHA512 c27bde89645bf3f54caf45a430f9bcbead9660f2623512cd30a59f43e0ed5017e27b4677644c78583412f0a075f3cd8ea1ffbfd86cf7c963cc5a7405fb38f11e
  • SSDEEP 6144:MeeJ4X72EGd0+ZiNikL4pAvsBwKZmlulAepvpCNK969uHzouuUibYRaCzz:64L2EE6NFL4pAvsBwWwZo/La
  • TLSH
    T182B401C8DA85C6A6E7B0D7B1F819DE056600BCF9B5F0B24D5536B2D84B323D8F523298
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryf9executionformbookpersistenceratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2