General
-
Target
5939356c2c0aad4e9fdcf3ee9ee412f4_JaffaCakes118
-
Size
750KB
-
Sample
240519-h8abyagd2w
-
MD5
5939356c2c0aad4e9fdcf3ee9ee412f4
-
SHA1
5fbb5cea57afa1dc97afdab98d399fba70cc7e14
-
SHA256
51b6e66830ed3c735e61530f8d1d22773a0fe7ee4c3548e46785492378ffc93d
-
SHA512
628f926c1177796480666cd82ee754e4a0b9d670ad29d2f7e44eb1af241f0b2b22be7d26d912b01bad7064f7431a1e4bb3f3ca390298db26baa31e11c7d9e87d
-
SSDEEP
12288:GF0wFQtr2hf4pz2McEwmXHeAsmZfL9tGwyd2GSt9x33POb1BRUEjGkEH:gNuw9e2MzXHFdZjC4f3fOb3jG
Static task
static1
Behavioral task
behavioral1
Sample
MTM2019-2 ph12 RESG.exe
Resource
win7-20240221-en
Malware Config
Extracted
formbook
3.9
bi
paulmeehanart.com
east-parker.com
brenttitcomb.com
joannaoon.com
pufrzgl.com
jconscomml.com
alyssafergusonart.com
yuperspective.com
sheseed.com
soicausieuchuan102.com
facexl.com
greenmountainpwc.com
perthbusinessclass.com
gerpling24.com
frbzf.com
netsycosmetics.co.uk
qiulen.com
connecticutstudent.loan
mclellansautomotive.net
kaifanghuashi.com
changshajinfu.com
rapidcommand.win
danielmontemusic.online
buystilnox.com
acfreemag16.com
suzyrosadesigns.com
meihengsheng.com
silverlligence.com
6kfn00nu6.biz
kentlawaetz.com
kysumientay.com
samoconnorphotography.com
nhenhenhem.com
angelabellaflores.com
jdfinp2p.com
0d1zerouser.loan
titanachockey.com
ivanllamas07.net
serviciotecnicobogota.biz
cacristoviene.com
c7768.com
hannibalchew.tech
bootsiemwc.com
yinzhenzhong.com
jpdlbu.ink
genteysazon.com
blainewellnessday.com
rekindlingthewaters.net
xn--bqry8cez7cy8z.com
thaimassage-leonberg.gmbh
blackgirlpretty.com
jamsessionpodcast.com
anwenorg.com
adventureasset.com
helpmeronda.tech
trendgou.com
happytreeartistry.com
rupertfernandes.com
ebisu-bar-k.com
tzgabo.com
focusandship.com
wellaweboard.com
hepublic.com
www215860.com
ajexin.com
Targets
-
-
Target
MTM2019-2 ph12 RESG.exe
-
Size
1.6MB
-
MD5
ca6397f8234b085dbffcd71872910163
-
SHA1
aed7c39031d764e25c5758a3c276144cee36a131
-
SHA256
cd4b7cfc524a98551a90fccc7110e52fcce550152cf1ad1017fba87c68faab1d
-
SHA512
6221ddef49a594636f172335e01328d99d75aa2974c9935d10d244504e810682c61b63ea7db94425b89a1302947e597a50ec8444a607d72434e631532f90820a
-
SSDEEP
24576:+AHnh+eWsN3skA4RV1Hom2KXMmHa2uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuyCSbY:ph+ZkldoPK8Yajl0
-
Formbook payload
-
Adds policy Run key to start application
-
Suspicious use of SetThreadContext
-