General

  • Target

    ed67a014369cbf061b4464b77c3765c0_JaffaCakes118

  • Size

    764KB

  • Sample

    240920-mm6v8ssalf

  • MD5

    ed67a014369cbf061b4464b77c3765c0

  • SHA1

    ee4eccd455b179d3b62aa5b813d6def9f40d0f67

  • SHA256

    85dc1d019667588686df02bc9e2ab3b40730bc826404669e0c2c70b27d679407

  • SHA512

    3d8e06276fd9eef01d50c756e8bdea6c5fd4220defc1e793c8c6078babaab630f676b0e7b06d7f32ef6cad24dd5667759dcdbb27dd62e7e861b6da39bc3e61d3

  • SSDEEP

    12288:AYIjfe/f3oHPabS8qV/z2cuDqZxZYYut:AY733oHyrq9z2G

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

pe

Decoy

blackcatproud.com

kddgu.info

jhholiday.com

woshunwang.com

qrvou.info

yinuojie.com

404arabs.com

diaojieorg.com

hsyfjj.com

medusabotanicals.com

ghay5c.com

wm785.com

bikeandart.com

ygyroadside.info

whitewings.biz

4pointpartnersbv.com

tukangsedotwc.net

democrataward.com

systemtraffic2updating.win

thevlu.com

Targets

    • Target

      ed67a014369cbf061b4464b77c3765c0_JaffaCakes118

    • Size

      764KB

    • MD5

      ed67a014369cbf061b4464b77c3765c0

    • SHA1

      ee4eccd455b179d3b62aa5b813d6def9f40d0f67

    • SHA256

      85dc1d019667588686df02bc9e2ab3b40730bc826404669e0c2c70b27d679407

    • SHA512

      3d8e06276fd9eef01d50c756e8bdea6c5fd4220defc1e793c8c6078babaab630f676b0e7b06d7f32ef6cad24dd5667759dcdbb27dd62e7e861b6da39bc3e61d3

    • SSDEEP

      12288:AYIjfe/f3oHPabS8qV/z2cuDqZxZYYut:AY733oHyrq9z2G

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks