General

  • Target

    cb18c25c997f934bf0ef7b0e869c79ae_JaffaCakes118

  • Size

    444KB

  • Sample

    240830-sph5va1are

  • MD5

    cb18c25c997f934bf0ef7b0e869c79ae

  • SHA1

    1700768b5b0d8670700aeb08feb91f6272310a1a

  • SHA256

    82c7e2de66d1f85945118b2c1056c53d893a1b7017077cb28d53759732aaad98

  • SHA512

    62a445dac0c5ff42fcb264de2159bc674f4c03c3b00c4c8ea233065722c3df04477d10d42c1b7278cc4422930f3301123792596605f7155145f058ba329b1ded

  • SSDEEP

    6144:t3YZlH4Y/htMCmaHKAVrs4ZoRsKhMOr2tcyiY+VfUYsuPk:t9CTeKtGsIYaUYsuPk

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

pe

Decoy

maytoken.com

esportsacademyhk.com

evanjjackson.com

creeksideatbethpage.life

thebigpigfarm.com

taiwanais.com

g-lectro.com

isabellafraiss.com

warriorfarm.com

todomascotasmerida.com

jonsnow.men

foodtreebd.com

thenorthernlightsmusic.com

weiai888.com

sklepfuji.com

coffindepot.com

swingerssociety.com

wuzixubingfa.com

iaruid.com

zgsdcf66.com

Targets

    • Target

      cb18c25c997f934bf0ef7b0e869c79ae_JaffaCakes118

    • Size

      444KB

    • MD5

      cb18c25c997f934bf0ef7b0e869c79ae

    • SHA1

      1700768b5b0d8670700aeb08feb91f6272310a1a

    • SHA256

      82c7e2de66d1f85945118b2c1056c53d893a1b7017077cb28d53759732aaad98

    • SHA512

      62a445dac0c5ff42fcb264de2159bc674f4c03c3b00c4c8ea233065722c3df04477d10d42c1b7278cc4422930f3301123792596605f7155145f058ba329b1ded

    • SSDEEP

      6144:t3YZlH4Y/htMCmaHKAVrs4ZoRsKhMOr2tcyiY+VfUYsuPk:t9CTeKtGsIYaUYsuPk

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks