General
-
Target
4e94655c7c0870f82b0c339638abc3e0_JaffaCakes118
-
Size
329KB
-
Sample
240331-gavdsaee91
-
MD5
4e94655c7c0870f82b0c339638abc3e0
-
SHA1
cf56cf4de4820b4bd89c70f8174a7b3e972ab91a
-
SHA256
215996b99ee60717a892b741501bcde2420f961b3c17dbc67bfc8bc003a61138
-
SHA512
4f1cb37d4d9179606a99c4fe059aa71fce5ca1fb9e80f005a58dc49470ca1f841dd90a2e53a10affcfb633f83dd39b8982ef4a3d52f62a255d77272fc02979ea
-
SSDEEP
6144:+0KU5GpM8F/cPshw/pw74VRiTouojB/zJa6EjFtz0s/3:+0KU5qM8NcPsO/pA4pusIFtzN/3
Malware Config
Extracted
formbook
4.1
dn7r
eventphotographerdfw.com
thehalalcoinstaking.com
philipfaziofineart.com
intercoh.com
gaiaseyephotography.com
chatbotforrealestate.com
lovelancemg.com
marlieskasberger.com
elcongoenespanol.info
lepirecredit.com
distribution-concept.com
e99game.com
exit11festival.com
twodollartoothbrushclub.com
cocktailsandlawn.com
performimprove.network
24horas-telefono-11840.com
cosmossify.com
kellenleote.com
perovskite.energy
Targets
-
-
Target
order list.com
-
Size
252KB
-
MD5
8e07e5bfcdfb06fe00332798af731c1b
-
SHA1
f937ba7129daff91a011aaa5ce767db5763c359c
-
SHA256
1f7edeff96ea1955ea6642e4d739f6a98cb1315d9f78fe23ae3419fb24878103
-
SHA512
c2ec48656985a8190f10305fc8d11162453457322fceb11c95cd87e0a18099697e3d815db42e0f82166edcf02170c2bf85b4c034d1daeeb285a8466ddaef9318
-
SSDEEP
6144:wBlL/cdXKcGiepdi1NxLY4kMa/ETi3d09+cy5x7Yq:CedzkEr0x/ETYsjyX8q
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/bpibxkjlns.dll
-
Size
31KB
-
MD5
baf456a0f50b4a00dd3a624bb46b5950
-
SHA1
1d896ed35f724cd6e5168ebc7e5e670f85eb36f9
-
SHA256
de5e7a9b204e8cdeaf9c002a81732d8487c4547c0c98d353cab896f92b8c851d
-
SHA512
e883bfaed10a560ac83b8466e524032148873b3c70411da25124db486863413749cec9e5b80cf593a2f81bca23b139172d8c8e49eb0a2b744b497c5f3a3b13ae
-
SSDEEP
768:BODooxdJWQvv5RaMcJEJ8f88dHamWlYQodqFuO0oRy:BOFJWK5fIaZlYbil0Cy
Score3/10 -