General

  • Target
    e5fb31f7be04068fc088418d642e292b_JaffaCakes118
  • Size 268KB
  • Sample240917-d67r7sshkm
  • SHA256 42154d0805933548da9b7a9fbbce40be9e155091e6f96ed4ce324c21b3430b20
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • formbook

Version
  • 3.7

Campaign
  • ch27

Decoy
  • lijianfans.net

  • keziamandelin.com

  • goldenoceanoutdoor.com

  • isilvaphotography.com

  • cindypantoja.com

  • animalfriendsllc.com

  • diikey.com

  • trainerpoqe.men

  • berastours.com

  • pagelink.info

  • lemsinternetbiz.site

  • cervezascolder.com

  • bombom.site

  • heromorfin.com

  • eltirachinasasturiano.com

  • spacity.biz

  • microbladingshop.net

  • tfworkstation.com

  • mengxiaoxi.net

  • ggg585.com

Targets

    • Target
      e5fb31f7be04068fc088418d642e292b_JaffaCakes118
    • Size 268KB
    • SHA256 42154d0805933548da9b7a9fbbce40be9e155091e6f96ed4ce324c21b3430b20
    • MD5 SHA1 SHA512 SSDEEP
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks