General

  • Target

    e5fb31f7be04068fc088418d642e292b_JaffaCakes118

  • Size

    268KB

  • Sample

    240917-d67r7sshkm

  • MD5

    e5fb31f7be04068fc088418d642e292b

  • SHA1

    9c043826be0f12c96dce9a58b6793dfe33926589

  • SHA256

    42154d0805933548da9b7a9fbbce40be9e155091e6f96ed4ce324c21b3430b20

  • SHA512

    717dd2e37ca44041293dfda5bd6a455c83d33d62e55a0d34bfdbe90deddf12e65dafff3819de3a38e59d241cd2aca2f7ecbfe366935b6fff0a21846176ae9299

  • SSDEEP

    6144:AyaOH6GdiNywts0oFiv4HmdChI7Cm6Vad:+f3i44GdyIH

Malware Config

Extracted

Family

formbook

Version

3.7

Campaign

ch27

Decoy

lijianfans.net

keziamandelin.com

goldenoceanoutdoor.com

isilvaphotography.com

cindypantoja.com

animalfriendsllc.com

diikey.com

trainerpoqe.men

berastours.com

pagelink.info

lemsinternetbiz.site

cervezascolder.com

bombom.site

heromorfin.com

eltirachinasasturiano.com

spacity.biz

microbladingshop.net

tfworkstation.com

mengxiaoxi.net

ggg585.com

Targets

    • Target

      e5fb31f7be04068fc088418d642e292b_JaffaCakes118

    • Size

      268KB

    • MD5

      e5fb31f7be04068fc088418d642e292b

    • SHA1

      9c043826be0f12c96dce9a58b6793dfe33926589

    • SHA256

      42154d0805933548da9b7a9fbbce40be9e155091e6f96ed4ce324c21b3430b20

    • SHA512

      717dd2e37ca44041293dfda5bd6a455c83d33d62e55a0d34bfdbe90deddf12e65dafff3819de3a38e59d241cd2aca2f7ecbfe366935b6fff0a21846176ae9299

    • SSDEEP

      6144:AyaOH6GdiNywts0oFiv4HmdChI7Cm6Vad:+f3i44GdyIH

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks