Extracted

• • Target
    jaffacakes118_Trojan-Spy.Win32.Noon.advo.edc1f83624eef11758ccdbda468d4e39
  • Size 620KB
  • SHA256 510f6813fe54ad90d648d478d974bf6fdad8e11dddcf191a2152dc2d1ccf0edf
  • MD5 edc1f83624eef11758ccdbda468d4e39
  • SHA1 98f3c051babf29527e60ba5cb80db4f8e9e8db6c
  • SHA512 34842c41347a1b3a075249429f35d747907958d3455e10d3adc8050569ff3df10b8b107e84576737d596c19b625353f81f0f875aa213ba2f09370f239e07aa56
  • SSDEEP 12288:fi5oEjt8a2gaQNGf0+ACZk7atWvg7R8H7xlWDTOBjvx+sGbGS7GS2jy6qA:fcd1NGf0+PZkVtWPQE6MV6
  • TLSH
    T1D5D4CF36350C9832F89AA2F2DC6524DFD5143D8A4ED3848B12D6BACFBD351238A2CD57
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  f9defense_evasiondiscoverydownloaderexecutionformbookguloaderpersistenceprivilege_escalationratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2