General

  • Target
    b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118
  • Size 1.1MB
  • Sample240617-ee1egssgra
  • SHA256 deccbaea4951de166f83748b3ed4bd5d06b49bfe53f7106694f15c7c3102f548
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • formbook

Version
  • 3.9

Campaign
  • re

Decoy
  • shumayuansu.com

  • falkerthaus.com

  • blondiefitness.com

  • lappair.reisen

  • miamiwindowtintingshop.com

  • vickeryhomesforsale.com

  • ohparisisburning.com

  • tipbong88.com

  • foxfarmroad.design

  • love-yournaturalhair.com

  • chanvuong.net

  • raw-materials-efficiency.com

  • negenomics.com

  • t0sinfe3fq.com

  • theconcussioninjury.com

  • paypalhelpservice.com

  • bensonsaddler.com

  • impcashmere.com

  • finddentalimplantsite.live

  • dianlonglawfirm.com

Targets

    • Target
      b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118
    • Size 1.1MB
    • SHA256 deccbaea4951de166f83748b3ed4bd5d06b49bfe53f7106694f15c7c3102f548
    • MD5 SHA1 SHA512 SSDEEP
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks