General

  • Target

    67d6cc23b3d706b688e2fc2bf86adeb2_JaffaCakes118

  • Size

    529KB

  • Sample

    240522-tky6yagf9y

  • MD5

    67d6cc23b3d706b688e2fc2bf86adeb2

  • SHA1

    129ca4404eeb7064d6c8f0ac6902004c103b1955

  • SHA256

    aeb152965dfacf939b0329628a69d1c5297bbae7090ee6aa40458aecc49613cc

  • SHA512

    0268bed3248babf5202f42f84e9403cc5b53db0857ee2a9f1e31f82c8c982c250d5a5f5fb14e622a30e04c6cf5de462b388a8ada64dd4bfb040b936d3ae7c47e

  • SSDEEP

    12288:17Q8838bm5PmPZvTH8T9xRAw7WXymM4aCRj1:omPZAT9Dp7WCmM4r

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

di

Decoy

countdown-mirage.com

fusion11tyler.com

xn--ccklb4p0b9c2f.site

tasucusahilemlak.com

edubcbe.com

phunulamdep.today

hsbei.com

molly20.com

creditcardtalks.com

simonadecors.com

sefakarabacak.com

plusong.com

mrcoursereview.com

dolphinaping.site

dgytwh.com

lestoilesart.com

dadshow.net

shinhanconvention.com

check-that-notice-works.com

fingerlakesprowashing.com

Targets

    • Target

      67d6cc23b3d706b688e2fc2bf86adeb2_JaffaCakes118

    • Size

      529KB

    • MD5

      67d6cc23b3d706b688e2fc2bf86adeb2

    • SHA1

      129ca4404eeb7064d6c8f0ac6902004c103b1955

    • SHA256

      aeb152965dfacf939b0329628a69d1c5297bbae7090ee6aa40458aecc49613cc

    • SHA512

      0268bed3248babf5202f42f84e9403cc5b53db0857ee2a9f1e31f82c8c982c250d5a5f5fb14e622a30e04c6cf5de462b388a8ada64dd4bfb040b936d3ae7c47e

    • SSDEEP

      12288:17Q8838bm5PmPZvTH8T9xRAw7WXymM4aCRj1:omPZAT9Dp7WCmM4r

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks