General

  • Target

    287e1c36c397420c0024ff68381d00b3_JaffaCakes118

  • Size

    358KB

  • Sample

    241009-bx4yvatblg

  • MD5

    287e1c36c397420c0024ff68381d00b3

  • SHA1

    745d47c2c85ee325b895e7891ff846aa71df1663

  • SHA256

    9689b3a9fe32cd705571559a79cfacbbf0e6ac9931f760cb44850be856922576

  • SHA512

    e891d94b10d5cdce85d6f179dd6984cb4132c8297552e2ac55e7277ca5bd5a115803581b85f17904167a133774149b8e7493dbb0ce9b532fe0072cbdaf8cdd87

  • SSDEEP

    6144:4x19xfRz9RzGhN7NLcaI3d4qRo1q0cX2Jje3gsn/2Js3kbC3NDiRzXgbhrUU5OPY:4x1fFTGjRLca8d1G1q0Dgwsn/as3kW9N

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

bd2

Decoy

coffeeflyer.com

joy-cars.com

excp0st.com

pancakesandprotein.com

teenboys.info

theperfectgiftshop.net

maomao2017.com

musiclabtacoma.com

taskrit.com

pthjxx.com

114man.com

worldsjsj.com

rjpmuztrygwn.online

casinotoponlineplay.technology

tm88z.com

navnoorkang.com

lazydogkennels.net

yisilv.com

usasubels.com

desperatehouse-lives.com

Targets

    • Target

      287e1c36c397420c0024ff68381d00b3_JaffaCakes118

    • Size

      358KB

    • MD5

      287e1c36c397420c0024ff68381d00b3

    • SHA1

      745d47c2c85ee325b895e7891ff846aa71df1663

    • SHA256

      9689b3a9fe32cd705571559a79cfacbbf0e6ac9931f760cb44850be856922576

    • SHA512

      e891d94b10d5cdce85d6f179dd6984cb4132c8297552e2ac55e7277ca5bd5a115803581b85f17904167a133774149b8e7493dbb0ce9b532fe0072cbdaf8cdd87

    • SSDEEP

      6144:4x19xfRz9RzGhN7NLcaI3d4qRo1q0cX2Jje3gsn/2Js3kbC3NDiRzXgbhrUU5OPY:4x1fFTGjRLca8d1G1q0Dgwsn/as3kW9N

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks