General

  • Target

    3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118

  • Size

    484KB

  • Sample

    240712-d4h13axank

  • MD5

    3bd9315fa824d7f8351d858ca5c12629

  • SHA1

    a19b2e80a240452e4fe251a9299bd5d30b66d709

  • SHA256

    20fd96b00deec9d95d0e251aa4c6885f85af415f8e776716399b4280ae8128f3

  • SHA512

    6fc7405b19ae91a3ad96dc91918eb2e7c2da0e2265a79f17f096c8d2b348ede7df51e2d4a2db69e3bd5aba40ba94e52bf52b374de48c81e0566932983095b38d

  • SSDEEP

    6144:Gbx0cXjCfjnhWQ+3HwOcc0WXJ4+5yk6kPFlom3iBX94AcGFCKrvvScZTHvxqVCHR:QOFPocc0WX64kmiqAcGXFZbAAt

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s3dy

Decoy

ravlygte.info

marketnewsville.online

flooring-envy.com

flavourhouston.com

donghohanghieunam.com

globleitsolutions.com

digitalgraphicarts.com

cupidbeautybar.com

cannavybes.com

negative-dsp.com

littledali.com

meltwatersoftware.info

blackdogland.com

danasales.com

mississippiscorecard.com

mainesmoker.com

sirenxinlilzixun.com

tychehang.com

gentciu.com

weckloltd.com

Targets

    • Target

      3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118

    • Size

      484KB

    • MD5

      3bd9315fa824d7f8351d858ca5c12629

    • SHA1

      a19b2e80a240452e4fe251a9299bd5d30b66d709

    • SHA256

      20fd96b00deec9d95d0e251aa4c6885f85af415f8e776716399b4280ae8128f3

    • SHA512

      6fc7405b19ae91a3ad96dc91918eb2e7c2da0e2265a79f17f096c8d2b348ede7df51e2d4a2db69e3bd5aba40ba94e52bf52b374de48c81e0566932983095b38d

    • SSDEEP

      6144:Gbx0cXjCfjnhWQ+3HwOcc0WXJ4+5yk6kPFlom3iBX94AcGFCKrvvScZTHvxqVCHR:QOFPocc0WX64kmiqAcGXFZbAAt

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks