General
-
Target
79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118
-
Size
873KB
-
Sample
240527-v544cscg54
-
MD5
79f04bd1fc5f9757f7979bb8cbefdd5e
-
SHA1
e34056989f520736af44df68d869b71a4d4d695f
-
SHA256
8aafecddd3b462d27c24000757496edb5c6bce1e6abff9157d5360457b0805d7
-
SHA512
40836cc07e0ea529e31c2b9e36c639d486aee5ec2c0fbcffdd7e006aa0f345eb96930833113e371719d6d5dac4c36a4ee60c62fdd776b2201fea3abff21671d2
-
SSDEEP
12288:UDb7BqrErn/mxx7E6vMJaxKwWoFJm6y2o/Yc4/P2x1AFZpqzN7FCIZZBzFs8dDkP:UFBrny7d7eqq2Z32AqhJz68dw
Malware Config
Extracted
formbook
4.1
tln
themayoparty.com
theselfloveknowing.com
fresnospeechpathologist.com
logopedieameliekerenae.com
creditcommoncents.com
saliwasims.com
steelmannews.com
pdsxinfuding.com
cashflowtoday.net
daddaenterprises.com
kjvrvg.com
onthejoblanguages.com
montieri.net
implusefit.com
proseo.digital
handymanwashingtondc.com
michahahn.com
tesla-vtc.com
andreasott.online
kalinsack.com
Targets
-
-
Target
79f04bd1fc5f9757f7979bb8cbefdd5e_JaffaCakes118
-
Size
873KB
-
MD5
79f04bd1fc5f9757f7979bb8cbefdd5e
-
SHA1
e34056989f520736af44df68d869b71a4d4d695f
-
SHA256
8aafecddd3b462d27c24000757496edb5c6bce1e6abff9157d5360457b0805d7
-
SHA512
40836cc07e0ea529e31c2b9e36c639d486aee5ec2c0fbcffdd7e006aa0f345eb96930833113e371719d6d5dac4c36a4ee60c62fdd776b2201fea3abff21671d2
-
SSDEEP
12288:UDb7BqrErn/mxx7E6vMJaxKwWoFJm6y2o/Yc4/P2x1AFZpqzN7FCIZZBzFs8dDkP:UFBrny7d7eqq2Z32AqhJz68dw
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-