General

  • Target

    a53ca5c60cc21e40dd31a7a7a68ba74b_JaffaCakes118

  • Size

    781KB

  • Sample

    240818-d6qhxswdmr

  • MD5

    a53ca5c60cc21e40dd31a7a7a68ba74b

  • SHA1

    55f98b7940c216decffbee9ea0927334f8d56785

  • SHA256

    8c5a90a4c4470d05fff7757920aa0a8bf56edab04f4eb926ba789652f1bfc74c

  • SHA512

    01c393ea54de3a5b20ca08820be67a2dcbd9bd99bb993f8293a3c6ab283aab096b362e569dd33600fece8acec9ec77a4a62dfe25290d96851d99b198a4c38fdd

  • SSDEEP

    12288:jsANYT/rTbYnFBznBjFcxN7j2/x4Z+7zTu2vRiZi6quXNLqB9pLoOn/fIHwkEN+n:D8/rTsfeiiZFqRjn/fgwkEN+vnVr1X

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

wle

Decoy

peterwangofficial.com

bhjchouse.com

belladermalotion.com

rickmccomas.com

bigtime80s.com

wilmington-pestcontrol.com

take2ya.com

bibakkitap.com

livelifemagazine.com

acp118.com

myneuro-gym.com

kolornaire.com

edgeband-china.com

aogiworld.com

svcor.net

112wp.com

malaysiawhitecoffee.com

packers-vsvikings.com

chintels.net

stefan.tools

Targets

    • Target

      a53ca5c60cc21e40dd31a7a7a68ba74b_JaffaCakes118

    • Size

      781KB

    • MD5

      a53ca5c60cc21e40dd31a7a7a68ba74b

    • SHA1

      55f98b7940c216decffbee9ea0927334f8d56785

    • SHA256

      8c5a90a4c4470d05fff7757920aa0a8bf56edab04f4eb926ba789652f1bfc74c

    • SHA512

      01c393ea54de3a5b20ca08820be67a2dcbd9bd99bb993f8293a3c6ab283aab096b362e569dd33600fece8acec9ec77a4a62dfe25290d96851d99b198a4c38fdd

    • SSDEEP

      12288:jsANYT/rTbYnFBznBjFcxN7j2/x4Z+7zTu2vRiZi6quXNLqB9pLoOn/fIHwkEN+n:D8/rTsfeiiZFqRjn/fgwkEN+vnVr1X

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks