General

  • Target

    d302a55d33c34c382c7518fdefd49efa_JaffaCakes118

  • Size

    873KB

  • Sample

    240907-2zrz6ssfqa

  • MD5

    d302a55d33c34c382c7518fdefd49efa

  • SHA1

    0601338d74705de83a331a7a60b7e175bc931329

  • SHA256

    34eeebc4197df0980b621253c336662f3868ccc65a5f99a832d47751d4d5384e

  • SHA512

    03d34237a54e0f32b400a49ba497de75dcf9b0c434c0826a8efa40bb4993c33431c8be7a555cf5f16f5ead02ab62fc0805144ba550da916624ca697819012a26

  • SSDEEP

    12288:8Db7BqrErn/mxx7E6vMJaxKwWoFJm6y2o/Yc4/P2x1AFWqjwomGgosFI0+jN7RS8:8FBrny7d7eqq2Z32osomGuFI0+jN7

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nk4

Decoy

teresaanaya.com

byronhobbs.com

altiizgara.com

reignsponsibly.com

kanistones.com

clickpk.site

aizzainvestments.com

bpqbq.com

openfitxbstretch.com

blackvoicesstore.com

yousefzaid.com

verdeaccounting.com

independentthoughtshow.com

fainlywatchdog.com

elreventondelsabor.com

spiceyourfood.com

1277hb.com

cesttoni.com

portalngs.com

turismoplayas.com

Targets

    • Target

      d302a55d33c34c382c7518fdefd49efa_JaffaCakes118

    • Size

      873KB

    • MD5

      d302a55d33c34c382c7518fdefd49efa

    • SHA1

      0601338d74705de83a331a7a60b7e175bc931329

    • SHA256

      34eeebc4197df0980b621253c336662f3868ccc65a5f99a832d47751d4d5384e

    • SHA512

      03d34237a54e0f32b400a49ba497de75dcf9b0c434c0826a8efa40bb4993c33431c8be7a555cf5f16f5ead02ab62fc0805144ba550da916624ca697819012a26

    • SSDEEP

      12288:8Db7BqrErn/mxx7E6vMJaxKwWoFJm6y2o/Yc4/P2x1AFWqjwomGgosFI0+jN7RS8:8FBrny7d7eqq2Z32osomGuFI0+jN7

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.