General

  • Target

    cbdd7feec1325ccdeedfc3f5ee9f7252_JaffaCakes118

  • Size

    441KB

  • Sample

    240830-3gtlqasdpb

  • MD5

    cbdd7feec1325ccdeedfc3f5ee9f7252

  • SHA1

    cb39d5450c2ebe95569dd70b5149e91a32035675

  • SHA256

    30a23a5cba3f21206da36e9aa74d872235fc7a25a3751b2bc977803ea4cefa2b

  • SHA512

    ef494e9f613c01f6e4229f4be599e3d32325925e0b3f7b4e1016023c883e4ab89cbba9ee5f6161c64658f835a95fd3599cc66cc096286fea4ae0811d5315d0f6

  • SSDEEP

    6144:wlGN+601s33fLUifia16Ybj0maWSkweMPX4SF3BIe2TCdR/4/nWSIvF68:FYmfIiMYbj0hPX4M2e2TGcn5Ivk8

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

endless

Decoy

brushedbyjoe.com

arcleyaler.info

51fortel.com

sideqik.biz

goodremedieshome.com

mode3london.com

acroofco.com

clxwou.online

edelweissbrokings.com

carolina-fever.com

k-hager.com

my-first-dildo.com

zuanpinart.com

estudiofuego.com

salihoglugidafmr.com

onlineforbooks.com

taitianrui.com

xn--zf0b677a8sflpn.com

franklindui.lawyer

wearefitlab23.com

Targets

    • Target

      cbdd7feec1325ccdeedfc3f5ee9f7252_JaffaCakes118

    • Size

      441KB

    • MD5

      cbdd7feec1325ccdeedfc3f5ee9f7252

    • SHA1

      cb39d5450c2ebe95569dd70b5149e91a32035675

    • SHA256

      30a23a5cba3f21206da36e9aa74d872235fc7a25a3751b2bc977803ea4cefa2b

    • SHA512

      ef494e9f613c01f6e4229f4be599e3d32325925e0b3f7b4e1016023c883e4ab89cbba9ee5f6161c64658f835a95fd3599cc66cc096286fea4ae0811d5315d0f6

    • SSDEEP

      6144:wlGN+601s33fLUifia16Ybj0maWSkweMPX4SF3BIe2TCdR/4/nWSIvF68:FYmfIiMYbj0hPX4M2e2TGcn5Ivk8

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks