General

  • Target
    72a08d74790b5cc675899057127071cb_JaffaCakes118
  • Size 246KB
  • Sample240525-vdv2dabe57
  • SHA256 e797f39f4c6816a5fb7261a80ec56f3aa6f80ab8c2a29e75b024b555552b373c
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • aofk

Decoy
  • theplanetviral.com

  • 51gayporn.com

  • mesathean.com

  • vaguidelines-updated.com

  • newuniverse.net

  • daveslehighvalleyvac.com

  • balikesirmasajsalonuu.com

  • chepinclub.com

  • shkafko.com

  • xn--eh3b11fp3f4me.com

  • qgochyljokbjjx.com

  • ashleetaylor.net

  • neckbeardnation.com

  • jordanthedev.com

  • pnwminiacs.com

  • tastyafrecipes.com

  • postmortemrecycled.com

  • bodypiercingblog.com

  • northwestclassicfirearms.com

  • manilagogo.com

Targets

    • Target
      72a08d74790b5cc675899057127071cb_JaffaCakes118
    • Size 246KB
    • SHA256 e797f39f4c6816a5fb7261a80ec56f3aa6f80ab8c2a29e75b024b555552b373c
    • MD5 SHA1 SHA512 SSDEEP
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks