General

  • Target

    5405c83a8da9225a22ac4a575ac6454b_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240518-k9qfnadc3x

  • MD5

    5405c83a8da9225a22ac4a575ac6454b

  • SHA1

    53f316b023ace5b15d0243662d3b3f047f583d3e

  • SHA256

    cbbab3c504af017289c1032c98f22801025ad9309636342a9d59eb49f7bb1fbb

  • SHA512

    463c24bcee9e3fb87bb3899327a35b8db67e86ec4a76486f0d25794093a572bb58289a901aa539d44968e06d0d6ac3f7e34e1e09bb1fef93c94b22d58fd52c50

  • SSDEEP

    12288:k3HxvTzdIhHc6s6fvAHL8EIEgCPcuxWlsmP8H7zNA8vF0FBDku1j+W7kL9Hnqsx:k3x3S7s6fvAHa1eWnEb6+Ow67IKHKjI

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

h340

Decoy

xn--vnur8gv01a.com

beginningin1998.com

superfiremusic.com

camilaarboleda.com

www817456.com

tigadolok.com

prestigehdtvs.com

ray-software.com

esthemaxchina.com

melandmomtravel.info

5qs3p4hm.biz

kenstokesphotography.com

zyype.info

leeloo.live

joborigo.com

asfps.cloud

earningtheletter.com

duraspares.com

groupedeals.com

highvoltagetatoo.com

Targets

    • Target

      5405c83a8da9225a22ac4a575ac6454b_JaffaCakes118

    • Size

      1.2MB

    • MD5

      5405c83a8da9225a22ac4a575ac6454b

    • SHA1

      53f316b023ace5b15d0243662d3b3f047f583d3e

    • SHA256

      cbbab3c504af017289c1032c98f22801025ad9309636342a9d59eb49f7bb1fbb

    • SHA512

      463c24bcee9e3fb87bb3899327a35b8db67e86ec4a76486f0d25794093a572bb58289a901aa539d44968e06d0d6ac3f7e34e1e09bb1fef93c94b22d58fd52c50

    • SSDEEP

      12288:k3HxvTzdIhHc6s6fvAHL8EIEgCPcuxWlsmP8H7zNA8vF0FBDku1j+W7kL9Hnqsx:k3x3S7s6fvAHa1eWnEb6+Ow67IKHKjI

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks