General

  • Target

    a4cef4466323bbc3f0e665f339629db5_JaffaCakes118

  • Size

    758KB

  • Sample

    240403-ybyk9saf4s

  • MD5

    a4cef4466323bbc3f0e665f339629db5

  • SHA1

    06452f66b0fd5093513c29fe28c04a826721067b

  • SHA256

    76ce63841f53dd035159b8feed432cf72e114ffd57344d8fae525f0a350856f4

  • SHA512

    c3611d4447a3fd8c2ad557a63e8aac72a183a2a5158ae10847f115f3a8a32c42c36b5be14c776cad20b0540b3f9ddcf977d22bcfbeebe58116588293e35d7e67

  • SSDEEP

    12288:o3Kyph08OGQuZLvqJFTPpHVifhCmJKHusm8UqtG+6/lAssilcd0QNf3uGNBTqAF3:+4nGQYTq1ahCRHcJ+6/OsV60u

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

snr6

Decoy

jjglassmi1.com

vpsseattle.com

drfllc.top

staycoolonline.com

eptlove.com

solusimatasehat.site

ionrarecharlestonproperties.com

b3eflucg.xyz

tvchosun-usa.com

mmahzxwzsadqlshop.life

gospelimport.com

demoapps.website

jackburst54.com

99rocket.education

ccbwithbri.com

trapperairsoft.com

useroadly.com

ralphlaurenonline-nl.com

loanmaster4u.com

champ-beauty-tomigaoka-nail.com

Targets

    • Target

      a4cef4466323bbc3f0e665f339629db5_JaffaCakes118

    • Size

      758KB

    • MD5

      a4cef4466323bbc3f0e665f339629db5

    • SHA1

      06452f66b0fd5093513c29fe28c04a826721067b

    • SHA256

      76ce63841f53dd035159b8feed432cf72e114ffd57344d8fae525f0a350856f4

    • SHA512

      c3611d4447a3fd8c2ad557a63e8aac72a183a2a5158ae10847f115f3a8a32c42c36b5be14c776cad20b0540b3f9ddcf977d22bcfbeebe58116588293e35d7e67

    • SSDEEP

      12288:o3Kyph08OGQuZLvqJFTPpHVifhCmJKHusm8UqtG+6/lAssilcd0QNf3uGNBTqAF3:+4nGQYTq1ahCRHcJ+6/OsV60u

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks