General

  • Target

    1d9d946599bbe47314f6dfa89f1c6e77_JaffaCakes118

  • Size

    681KB

  • Sample

    240506-v5rg9sfb53

  • MD5

    1d9d946599bbe47314f6dfa89f1c6e77

  • SHA1

    7bbdeb9670c8dc3a4f529b41b88cdd0900acad00

  • SHA256

    15af9bb36b7a51efea7ab70d98a29ef7059f4f5b7178fef0aaff0671bf6c9386

  • SHA512

    667d49dbd33d8e62da14ec03d1b138fee8df6ca580112e81437225bce9be3853d4485922f902206412342dede766140b44bfe718e6b567ff5ed75f6cd6e675cd

  • SSDEEP

    12288:SY2SRgOu9uO2dm4rqoXa3p1nirvopIBP8A1cNChQS0Vc:SxSJvObTV37irvopI1rVR

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nk4

Decoy

teresaanaya.com

byronhobbs.com

altiizgara.com

reignsponsibly.com

kanistones.com

clickpk.site

aizzainvestments.com

bpqbq.com

openfitxbstretch.com

blackvoicesstore.com

yousefzaid.com

verdeaccounting.com

independentthoughtshow.com

fainlywatchdog.com

elreventondelsabor.com

spiceyourfood.com

1277hb.com

cesttoni.com

portalngs.com

turismoplayas.com

Targets

    • Target

      1d9d946599bbe47314f6dfa89f1c6e77_JaffaCakes118

    • Size

      681KB

    • MD5

      1d9d946599bbe47314f6dfa89f1c6e77

    • SHA1

      7bbdeb9670c8dc3a4f529b41b88cdd0900acad00

    • SHA256

      15af9bb36b7a51efea7ab70d98a29ef7059f4f5b7178fef0aaff0671bf6c9386

    • SHA512

      667d49dbd33d8e62da14ec03d1b138fee8df6ca580112e81437225bce9be3853d4485922f902206412342dede766140b44bfe718e6b567ff5ed75f6cd6e675cd

    • SSDEEP

      12288:SY2SRgOu9uO2dm4rqoXa3p1nirvopIBP8A1cNChQS0Vc:SxSJvObTV37irvopI1rVR

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks