General
-
Target
202a5d15ae9926a1dec141ed13065ad5_JaffaCakes118
-
Size
501KB
-
Sample
240507-lbhtlaab5y
-
MD5
202a5d15ae9926a1dec141ed13065ad5
-
SHA1
97a84b26c9f2f8a89fbbd8e3c35f673d17704fdf
-
SHA256
94e25372afeae0e0ef0dad8a783a6534e85f226734ba0ef2fd31625cec9f30c3
-
SHA512
48db4216a95b40d0f96384a9c3acdf7bc40a1fa7005a5b67a5b45475d8f039dccc579800932019e985952bc018219943f89c9bd59a7e83d57e0a7ba3b411a167
-
SSDEEP
12288:4N5H2IYf7y99IjxHncQNGt0ToygPUTbRMCdZW:yTYf7R9PNGtMAUTbK
Malware Config
Extracted
formbook
3.9
um
tophandbagmart.com
indycabinetconnection.com
lastmonthsnews.com
schoolofgeneius.com
talkingtoms.com
pleasefixmyheat.com
nvdough.com
tauruslegal.com
designercoverscustom.com
clubdevfun.com
pourpop.com
republiccreditcoin.com
nmochat.com
techpriors.com
apartmentsomr.com
edjamesjones.com
hxtfgs.com
betturka.media
organicwaisttrainingcorset.com
foxtrotfilm.com
Targets
-
-
Target
202a5d15ae9926a1dec141ed13065ad5_JaffaCakes118
-
Size
501KB
-
MD5
202a5d15ae9926a1dec141ed13065ad5
-
SHA1
97a84b26c9f2f8a89fbbd8e3c35f673d17704fdf
-
SHA256
94e25372afeae0e0ef0dad8a783a6534e85f226734ba0ef2fd31625cec9f30c3
-
SHA512
48db4216a95b40d0f96384a9c3acdf7bc40a1fa7005a5b67a5b45475d8f039dccc579800932019e985952bc018219943f89c9bd59a7e83d57e0a7ba3b411a167
-
SSDEEP
12288:4N5H2IYf7y99IjxHncQNGt0ToygPUTbRMCdZW:yTYf7R9PNGtMAUTbK
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-