General

  • Target

    41de94b55b351ea7a5f8f39ed6502941_JaffaCakes118

  • Size

    426KB

  • Sample

    240514-r36bvsbe94

  • MD5

    41de94b55b351ea7a5f8f39ed6502941

  • SHA1

    4e8b131bfce348d862a012fb62aba6cda7b9eb64

  • SHA256

    c4ce612dfb04f8c5662918a751dfc3959a57be48baea6e94b33d2d344debee04

  • SHA512

    6c61c043dc2a23b0b9efa4a964bd4d10b17832b80c5b9b2f1b8d94dcbebbc73dbfa9d8b15596c61d5e0d945ad27e1eee6f6927c4f270311cd90986a411b999b7

  • SSDEEP

    12288:LoVclFg1jKxLforEQha005XUkdPSF+sBAEf5k:5gtKxjorC0oUkdKlKq5

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

aofk

Decoy

theplanetviral.com

51gayporn.com

mesathean.com

vaguidelines-updated.com

newuniverse.net

daveslehighvalleyvac.com

balikesirmasajsalonuu.com

chepinclub.com

shkafko.com

xn--eh3b11fp3f4me.com

qgochyljokbjjx.com

ashleetaylor.net

neckbeardnation.com

jordanthedev.com

pnwminiacs.com

tastyafrecipes.com

postmortemrecycled.com

bodypiercingblog.com

northwestclassicfirearms.com

manilagogo.com

Targets

    • Target

      41de94b55b351ea7a5f8f39ed6502941_JaffaCakes118

    • Size

      426KB

    • MD5

      41de94b55b351ea7a5f8f39ed6502941

    • SHA1

      4e8b131bfce348d862a012fb62aba6cda7b9eb64

    • SHA256

      c4ce612dfb04f8c5662918a751dfc3959a57be48baea6e94b33d2d344debee04

    • SHA512

      6c61c043dc2a23b0b9efa4a964bd4d10b17832b80c5b9b2f1b8d94dcbebbc73dbfa9d8b15596c61d5e0d945ad27e1eee6f6927c4f270311cd90986a411b999b7

    • SSDEEP

      12288:LoVclFg1jKxLforEQha005XUkdPSF+sBAEf5k:5gtKxjorC0oUkdKlKq5

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks