General

  • Target

    14591d9910e624ab16feea7ed087fabf_JaffaCakes118

  • Size

    346KB

  • Sample

    240504-y7ywxadd35

  • MD5

    14591d9910e624ab16feea7ed087fabf

  • SHA1

    7526af35505b214ea6c55ae68cf3b00242b2bb67

  • SHA256

    54dfc63b3e6e5cc56ffc01ba5c56ec6018886d3eac87f596ef378fbeebcf13f2

  • SHA512

    c8c50a3a1f43861c19912208dcf7c06b69aaf4ccf997bba9a3545f44a11fae11fa3bf0cc671b430e7320eb44dcf6cbb97b22665c6f87c374b8d6d2b9cbe9e8fd

  • SSDEEP

    6144:S58x3qwSG7IXDf20O1L/URmBzpBW9OIFRft/BHK93td/2yGm0a+ogV8gQmiE:Nx3q1mo7c1L/UArW93FRFZHW3DdJe4mX

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

di

Decoy

rhinogram.win

flood-web.com

xedienvinfast.tech

loansed.com

490xtt.info

jackfrischonline.com

pewarisservices.com

fylmz.com

kimclarkephotography.com

robertmaier.net

sergiogabrielfarias.com

luxurybedroomfurniture.com

rehobothtoday.net

mihealthconsulting.com

20lovesongsalbums.com

zipformoniline.com

lifan-parts.com

notitanswin.com

timsmowersandmore.com

upskillify.com

Targets

    • Target

      14591d9910e624ab16feea7ed087fabf_JaffaCakes118

    • Size

      346KB

    • MD5

      14591d9910e624ab16feea7ed087fabf

    • SHA1

      7526af35505b214ea6c55ae68cf3b00242b2bb67

    • SHA256

      54dfc63b3e6e5cc56ffc01ba5c56ec6018886d3eac87f596ef378fbeebcf13f2

    • SHA512

      c8c50a3a1f43861c19912208dcf7c06b69aaf4ccf997bba9a3545f44a11fae11fa3bf0cc671b430e7320eb44dcf6cbb97b22665c6f87c374b8d6d2b9cbe9e8fd

    • SSDEEP

      6144:S58x3qwSG7IXDf20O1L/URmBzpBW9OIFRft/BHK93td/2yGm0a+ogV8gQmiE:Nx3q1mo7c1L/UArW93FRFZHW3DdJe4mX

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/Splash.dll

    • Size

      4KB

    • MD5

      3f35f73787f0c3bb5e59445fb18ade0d

    • SHA1

      f1566faff96c3988cfc28dc7d433094b6348cdbf

    • SHA256

      5570969d22a33c23b60c5f5536f781219e458a869b77b8dde4a94cc124ee4de6

    • SHA512

      45c42ea95f53a3b8a3fd74bd55ad6f0b3f2b91dd969104de845fd819fe307dec2b4d472bee45554500b0c51052ee82ac98196e894af806edf67a947328474e57

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      fbe295e5a1acfbd0a6271898f885fe6a

    • SHA1

      d6d205922e61635472efb13c2bb92c9ac6cb96da

    • SHA256

      a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

    • SHA512

      2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

    • SSDEEP

      192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4

    Score
    3/10
    • Target

      $PLUGINSDIR/UserInfo.dll

    • Size

      4KB

    • MD5

      7836f464ae0102452e94a363b491b759

    • SHA1

      59909a48448b99e2eb9cd336d81d60764da59f31

    • SHA256

      11adf8916947b5a20a071b494fa034cf62769dcc6293a1340b29a5bb29ac8e87

    • SHA512

      5ed63eefa1b3b3caad4cb762ccb8419c05bcad3da3a7415235cda2d2a1f79eb018503ca30a0a92d6b72160327decea9a70c48e0c28de94dd67303d4aea4a02db

    Score
    3/10
    • Target

      $TEMP/dracone.dll

    • Size

      34KB

    • MD5

      9efcdaec062823e9749250da225dfe4d

    • SHA1

      1d6209a71c061729683ce81890f2d8c0c02c6e05

    • SHA256

      04904de1d15bb931cf85eadb7714bd53f7236de0fbc1f62c22aafb3470ff847c

    • SHA512

      b7faee0a4c769ee39fc11fe20c6ec362b6802e9fd7f81d8a495f1423263af8074cf995c1ff8d964680c10c3026e69ddb66e749b9b29784309502d805673a720a

    • SSDEEP

      768:tyxfTX4H2MoxHO1iB94vJfIhdV2GLkBrNj2+QE8u8VP:sfTX4zo85w+pa+J8f

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks