General
-
Target
50282da5093e3086fcde377c5e8e28bdJaffaCakes118.bin
-
Size
264KB
-
Sample
240517-3ag94sgc5z
-
MD5
50282da5093e3086fcde377c5e8e28bd
-
SHA1
f8468c9953686b0b77dfb6949866c68b628ce73d
-
SHA256
ca49aa362621679944ff2bb5c323dbb64ef5f0364dff1be6168c0657962296ec
-
SHA512
7a60e543a0b918591c7dcec8286175ce3c2e746c18055ac5439a9790469b9152ab2f50be6dc7d8f70d0b4002e7b51a9e32a685befb83dc971311deca65c46818
-
SSDEEP
6144:G/HhXZxNiTGAATtFH0zpVVDkYx7pvX9GD:iXZykBFHApVVLFdXsD
Malware Config
Extracted
formbook
3.9
j0g2z5t
nikolajslot.com
buysellhkonline.com
citytireandmuffler.com
moodichocolate.com
hiresses.com
1577584.com
chantaljamet.com
madamrichest.com
catfooddude.com
the9-city.com
dota2.red
risottomyway.com
cmbgw.com
ospreylandingfl.com
nmkindustries.com
video-cuentos.com
rktcont.net
suresourcetreatment.com
molinaroscollision.com
femmefetefashions.com
Targets
-
-
Target
50282da5093e3086fcde377c5e8e28bdJaffaCakes118.bin
-
Size
264KB
-
MD5
50282da5093e3086fcde377c5e8e28bd
-
SHA1
f8468c9953686b0b77dfb6949866c68b628ce73d
-
SHA256
ca49aa362621679944ff2bb5c323dbb64ef5f0364dff1be6168c0657962296ec
-
SHA512
7a60e543a0b918591c7dcec8286175ce3c2e746c18055ac5439a9790469b9152ab2f50be6dc7d8f70d0b4002e7b51a9e32a685befb83dc971311deca65c46818
-
SSDEEP
6144:G/HhXZxNiTGAATtFH0zpVVDkYx7pvX9GD:iXZykBFHApVVLFdXsD
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-