General
-
Target
fb90829fafd93c8e83d7c3dc8f6af02d_JaffaCakes118
-
Size
576KB
-
Sample
240420-bb7gvaca99
-
MD5
fb90829fafd93c8e83d7c3dc8f6af02d
-
SHA1
9332b9db7a6f13dec5028745d7411d04e8b31646
-
SHA256
8195d90a65592855ca10dc169e75e02dd055f91462c9993d18c879ee8431cfbf
-
SHA512
745a802ed92132073fb1594ae3cd4eee6b79e5672151453450c68866043cdf4bc9fb5634b152394678e439df041142f4f8f580b9b1e95c2585147ba365654d6c
-
SSDEEP
12288:CfoRkwemDzWLTXs5IruyES0AryyvhJfzt804zTnoilRMRFmM2mxQDhvx5VHVhJcb:CPqjW4dz32t52+2fvj6NBSi
Malware Config
Extracted
formbook
4.1
s2wt
yukiyamaapperal.com
rumasultan.store
japaese.com
quangphatloi.com
148atk.xyz
myheatstore.online
theedeneconomy.com
5xssc1.icu
krakensistem.xyz
gwangyo.com
lj-safe-keepingkokoka6.xyz
naturetheaterofoklahoma.com
perayaanwisudaitb.com
hrbsxxf.com
allencountypallet.com
vizit-app.com
startstartnow.com
inviertechile.com
haysneedlepotracks.com
cfdbestbroker.online
Targets
-
-
Target
fb90829fafd93c8e83d7c3dc8f6af02d_JaffaCakes118
-
Size
576KB
-
MD5
fb90829fafd93c8e83d7c3dc8f6af02d
-
SHA1
9332b9db7a6f13dec5028745d7411d04e8b31646
-
SHA256
8195d90a65592855ca10dc169e75e02dd055f91462c9993d18c879ee8431cfbf
-
SHA512
745a802ed92132073fb1594ae3cd4eee6b79e5672151453450c68866043cdf4bc9fb5634b152394678e439df041142f4f8f580b9b1e95c2585147ba365654d6c
-
SSDEEP
12288:CfoRkwemDzWLTXs5IruyES0AryyvhJfzt804zTnoilRMRFmM2mxQDhvx5VHVhJcb:CPqjW4dz32t52+2fvj6NBSi
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-