General
-
Target
444d3df9a20c68281353a091f76428e3_JaffaCakes118
-
Size
485KB
-
Sample
240515-dpvrbaed7z
-
MD5
444d3df9a20c68281353a091f76428e3
-
SHA1
b8659dab04ea1120bc696a1ee43b5d3022f830a5
-
SHA256
c222b07df99688f8ba5c35ce475d970b9fd0597420061d42707b553d00c788aa
-
SHA512
34556cf1a8ef045f8ae76f5d81216cae4748f51d3ecf81a12e2799c7ee4705457e47c5755c26bb40f296a27e7ad088c703d899bab8472f409b9b28b83ee6f1d7
-
SSDEEP
12288:IJzuW1RElKHFrTzh4NnsGvyrTOEEF1TQEULvz/:czuyElmlTMshrTC/kEULvD
Malware Config
Extracted
formbook
3.9
um
tophandbagmart.com
indycabinetconnection.com
lastmonthsnews.com
schoolofgeneius.com
talkingtoms.com
pleasefixmyheat.com
nvdough.com
tauruslegal.com
designercoverscustom.com
clubdevfun.com
pourpop.com
republiccreditcoin.com
nmochat.com
techpriors.com
apartmentsomr.com
edjamesjones.com
hxtfgs.com
betturka.media
organicwaisttrainingcorset.com
foxtrotfilm.com
Targets
-
-
Target
444d3df9a20c68281353a091f76428e3_JaffaCakes118
-
Size
485KB
-
MD5
444d3df9a20c68281353a091f76428e3
-
SHA1
b8659dab04ea1120bc696a1ee43b5d3022f830a5
-
SHA256
c222b07df99688f8ba5c35ce475d970b9fd0597420061d42707b553d00c788aa
-
SHA512
34556cf1a8ef045f8ae76f5d81216cae4748f51d3ecf81a12e2799c7ee4705457e47c5755c26bb40f296a27e7ad088c703d899bab8472f409b9b28b83ee6f1d7
-
SSDEEP
12288:IJzuW1RElKHFrTzh4NnsGvyrTOEEF1TQEULvz/:czuyElmlTMshrTC/kEULvD
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Adds policy Run key to start application
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-