General
-
Target
70eef5e2aeb9f20bd43597aa829a95e2_JaffaCakes118
-
Size
357KB
-
Sample
240525-fqzsrsfd59
-
MD5
70eef5e2aeb9f20bd43597aa829a95e2
-
SHA1
179331204a07257d0a8a5b43284fc2873ce9e620
-
SHA256
bca3d5eb15bb32ab76803b529838de3cf0217f3f247473e77dcb112d4b5a2517
-
SHA512
e5cd3b9405e8e2e79c2870082e60318364432c6cba3a1151fb74eed289c84d5133ae730bab715a810ed32b42c25386c9b422bfa6e9fad3c007749cad6dd15125
-
SSDEEP
6144:u/7ZlzuEeOtPY9jsrWzhLSwdMVsTrj5qwN4S3Fzs4+Xr0DP6:u/FbNY9jL9Swd+s39qzSRtKwDP
Malware Config
Extracted
formbook
3.9
ek
zhongyaoqiao.com
jeffstoolbox.com
flychemnb.com
charismigi.com
peoplerush.com
liyachun.com
fdjszp168.com
beautydepilation.info
yq173.com
tanwenbin.com
besttrustloan.com
batdongsanminhanh.com
jimanwendy.com
heresfrosty.com
bkdkc.info
5534nn.com
foundweb.info
westroam.com
danielleautumn.com
82zhan7728.com
Targets
-
-
Target
70eef5e2aeb9f20bd43597aa829a95e2_JaffaCakes118
-
Size
357KB
-
MD5
70eef5e2aeb9f20bd43597aa829a95e2
-
SHA1
179331204a07257d0a8a5b43284fc2873ce9e620
-
SHA256
bca3d5eb15bb32ab76803b529838de3cf0217f3f247473e77dcb112d4b5a2517
-
SHA512
e5cd3b9405e8e2e79c2870082e60318364432c6cba3a1151fb74eed289c84d5133ae730bab715a810ed32b42c25386c9b422bfa6e9fad3c007749cad6dd15125
-
SSDEEP
6144:u/7ZlzuEeOtPY9jsrWzhLSwdMVsTrj5qwN4S3Fzs4+Xr0DP6:u/FbNY9jL9Swd+s39qzSRtKwDP
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-