General

  • Target

    6828f30ad0bc6e1bbd3fd67afa24ebd9_JaffaCakes118

  • Size

    359KB

  • Sample

    240522-wt6y9abf47

  • MD5

    6828f30ad0bc6e1bbd3fd67afa24ebd9

  • SHA1

    4fb3cd6028de717756dd111d300ac8d2f7f0d7e9

  • SHA256

    9294d9ac18fc397c3c00df5c4a666f7e4f93e624afd0f44f9626c55cf924d7d9

  • SHA512

    eca4506fa425160f0a48dbb26f92ead9002e8a24337ebb3034c29af08b1beb51b2264f9473d44cdb932424e61d48e28bf6f9d84ce51768e8bf1a72a3e735d874

  • SSDEEP

    6144:78HZLiBye6H49w+zj2B+B/qy9/HjqSVywQ+6KV/meQrJ9SFfL6JR3Cs:IHZLK6HYwSqm/hpH2E3Q7PP9SFfL6D3

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

h343

Decoy

adelphai-llc.com

lzck05xn1.biz

15sheridan.info

bmscustomz.com

djrhub.com

banjoconnect.com

educationtranslators.com

pauldmoch.com

almagspanish.com

wwwjinsha581.com

schrodesign.com

jstello.com

bostontaxextensions.com

schubbink.com

bahis10girisi.info

nevadaclear.com

rajgagantravels.com

emoneyinsurance.ltd

workshop-blog.com

sc-corp.com

Targets

    • Target

      6828f30ad0bc6e1bbd3fd67afa24ebd9_JaffaCakes118

    • Size

      359KB

    • MD5

      6828f30ad0bc6e1bbd3fd67afa24ebd9

    • SHA1

      4fb3cd6028de717756dd111d300ac8d2f7f0d7e9

    • SHA256

      9294d9ac18fc397c3c00df5c4a666f7e4f93e624afd0f44f9626c55cf924d7d9

    • SHA512

      eca4506fa425160f0a48dbb26f92ead9002e8a24337ebb3034c29af08b1beb51b2264f9473d44cdb932424e61d48e28bf6f9d84ce51768e8bf1a72a3e735d874

    • SSDEEP

      6144:78HZLiBye6H49w+zj2B+B/qy9/HjqSVywQ+6KV/meQrJ9SFfL6JR3Cs:IHZLK6HYwSqm/hpH2E3Q7PP9SFfL6D3

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks