General

  • Target

    a445dd187c6dc7254da6d2f0d893f2fb_JaffaCakes118

  • Size

    510KB

  • Sample

    240403-xt9wksaa4w

  • MD5

    a445dd187c6dc7254da6d2f0d893f2fb

  • SHA1

    c0548d4ed4a9c2b68fbcf592e9a892fa587d5b0e

  • SHA256

    2a2187ae775f286c2400957b71aac1c550779fc6652a710d126546d4d4879f0f

  • SHA512

    ec8fb387474fe1a737ea46d67e5b2e363ecb6c35634e1af63e465fb487c8ae2b7684d128d8ea982d6234110dee83a4601b6fba64f05765a41927f580520c527e

  • SSDEEP

    12288:ogcvFMGTRKGUjCh6MCpMBWlzXu9TysHr6NOjqMIw+Nyqq9gdWf9od:qvAjCh6MCpnl+4xOOj3yqAgdio

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g8ni

Decoy

nickmowat.com

garethjame.biz

colibrilift.com

vulnerabilitylabs.one

neuro-ai-web-ru.website

16mcnaestreetmooneeponds.com

bestofstmaarten.net

meditelier.com

ragnarduke.com

escueladecampo.com

vongtayvn.com

inmemoriamaan.com

yourpeoplemanager.com

r6-gytr.com

agreeablebeauty.com

snpconfirms.com

tribalurq.quest

purafuse.com

cisco-training-course.com

wery.top

Targets

    • Target

      a445dd187c6dc7254da6d2f0d893f2fb_JaffaCakes118

    • Size

      510KB

    • MD5

      a445dd187c6dc7254da6d2f0d893f2fb

    • SHA1

      c0548d4ed4a9c2b68fbcf592e9a892fa587d5b0e

    • SHA256

      2a2187ae775f286c2400957b71aac1c550779fc6652a710d126546d4d4879f0f

    • SHA512

      ec8fb387474fe1a737ea46d67e5b2e363ecb6c35634e1af63e465fb487c8ae2b7684d128d8ea982d6234110dee83a4601b6fba64f05765a41927f580520c527e

    • SSDEEP

      12288:ogcvFMGTRKGUjCh6MCpMBWlzXu9TysHr6NOjqMIw+Nyqq9gdWf9od:qvAjCh6MCpnl+4xOOj3yqAgdio

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks