General

  • Target

    3bca962635a9f7486aafee1763e771a4_JaffaCakes118

  • Size

    299KB

  • Sample

    240512-yjlxfagd93

  • MD5

    3bca962635a9f7486aafee1763e771a4

  • SHA1

    f2a67e7f88c82f4380fa334cab924e7624617c0e

  • SHA256

    103ba9cccbdd7522730b2bebef111391cc421350ccab37738e7aa9c582b6a1ba

  • SHA512

    3d1a401cc68bcd335464e53def27c98200bf38ff4de5cc3d9f9ba884bff906ae37cfb217569573631377b2340e1a59fdcefd20bd816a1857cc108c5655eb5404

  • SSDEEP

    6144:rJz0YsiURd3Nof1u1mWhsGZTMEFQ0jUYgQtgm42xBdDQI29mCMaZ1O1zXSG:VDsb3GfUl1a0jcEW2xJ2pMarO1zXSG

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

t8a

Decoy

superbonsai.com

gastricosleevianaturkija.com

guojizk.com

cufusionevents.com

bangcamper.com

suprise.store

kunshanjiahe.com

allouth.net

www051345.com

pikio24.com

xjyamaha.com

bailinggames.com

myonlinedrone.com

zrikka.com

xiaotiedan.com

interets-100.com

walmartindia.online

emptyroadstudio.com

buildabully.com

daylightelectricalinc.net

Targets

    • Target

      ssssss.exe

    • Size

      412KB

    • MD5

      9486ac021feca509f61f55c66df4dc93

    • SHA1

      e6adcfb691c68ad639904abe3e4284258fcde282

    • SHA256

      af1f415e687826d5883d964ce99ae7845c107b43ce0ef38ead7184f159b15c9c

    • SHA512

      60b8efda9f410ef466840b1bea91b5db4084811cd8a71661725379962425aa68c7a9797e2e01c91a5e35b8cd18eeb24e7313553f707ea9041d88342f3d5bbbbc

    • SSDEEP

      12288:qzcgQc0XiaYYb8QUfIkanIfONuPDzzmON6n:azax7KCnMcuva4M

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks