General

  • Target

    078c1e70ed25852b3dae1f984f501278_JaffaCakes118

  • Size

    358KB

  • Sample

    241001-1mxjfssaqk

  • MD5

    078c1e70ed25852b3dae1f984f501278

  • SHA1

    4f6e56d77769566cc95eb81443d0eedb67176f01

  • SHA256

    217e843645ed39f10c63ac98870d3cca85e5f296186f6c25262bbf8bb2f95985

  • SHA512

    c62c66f8e7661d80fb7ee1eb7e5d80ab61cf160c833930f594c9ad3b20635867a5f7caa973299dd452b59c0c1868ea57a222b739d833e2e1a4184a5e170a8b40

  • SSDEEP

    6144:Zx19xfRz9RzGhN7NLcaI3d4qRo1q0cX2Jje3gsn/2Js3kbC3NDiRzXgbhrUU5OPQ:Zx1fFTGjRLca8d1G1q0Dgwsn/as3kW91

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

bd2

Decoy

coffeeflyer.com

joy-cars.com

excp0st.com

pancakesandprotein.com

teenboys.info

theperfectgiftshop.net

maomao2017.com

musiclabtacoma.com

taskrit.com

pthjxx.com

114man.com

worldsjsj.com

rjpmuztrygwn.online

casinotoponlineplay.technology

tm88z.com

navnoorkang.com

lazydogkennels.net

yisilv.com

usasubels.com

desperatehouse-lives.com

Targets

    • Target

      078c1e70ed25852b3dae1f984f501278_JaffaCakes118

    • Size

      358KB

    • MD5

      078c1e70ed25852b3dae1f984f501278

    • SHA1

      4f6e56d77769566cc95eb81443d0eedb67176f01

    • SHA256

      217e843645ed39f10c63ac98870d3cca85e5f296186f6c25262bbf8bb2f95985

    • SHA512

      c62c66f8e7661d80fb7ee1eb7e5d80ab61cf160c833930f594c9ad3b20635867a5f7caa973299dd452b59c0c1868ea57a222b739d833e2e1a4184a5e170a8b40

    • SSDEEP

      6144:Zx19xfRz9RzGhN7NLcaI3d4qRo1q0cX2Jje3gsn/2Js3kbC3NDiRzXgbhrUU5OPQ:Zx1fFTGjRLca8d1G1q0Dgwsn/as3kW91

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks