General

  • Target

    53738bfb840283b8d8e150ac58ab778d_JaffaCakes118

  • Size

    358KB

  • Sample

    241017-ypzqgstbla

  • MD5

    53738bfb840283b8d8e150ac58ab778d

  • SHA1

    81d22ff646246995fa7494933502a68350dbb749

  • SHA256

    f703f0563353e069adc4a069b4fcd3af49d363d319eb0a6ed30897a257a019cc

  • SHA512

    e9cba8ab381d425510fac947a53680c415fcb6178c990ee6eb6e1389245ec7653178c3c83131439995589d407ce4af280239548281161d201c5182323e99d644

  • SSDEEP

    6144:Lx19xfRz9RzGhN7NLcaI3d4qRo1q0cX2Jje3gsn/2Js3kbC3NDiRzXgbhrUU5OPN:Lx1fFTGjRLca8d1G1q0Dgwsn/as3kW9l

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

bd2

Decoy

coffeeflyer.com

joy-cars.com

excp0st.com

pancakesandprotein.com

teenboys.info

theperfectgiftshop.net

maomao2017.com

musiclabtacoma.com

taskrit.com

pthjxx.com

114man.com

worldsjsj.com

rjpmuztrygwn.online

casinotoponlineplay.technology

tm88z.com

navnoorkang.com

lazydogkennels.net

yisilv.com

usasubels.com

desperatehouse-lives.com

Targets

    • Target

      53738bfb840283b8d8e150ac58ab778d_JaffaCakes118

    • Size

      358KB

    • MD5

      53738bfb840283b8d8e150ac58ab778d

    • SHA1

      81d22ff646246995fa7494933502a68350dbb749

    • SHA256

      f703f0563353e069adc4a069b4fcd3af49d363d319eb0a6ed30897a257a019cc

    • SHA512

      e9cba8ab381d425510fac947a53680c415fcb6178c990ee6eb6e1389245ec7653178c3c83131439995589d407ce4af280239548281161d201c5182323e99d644

    • SSDEEP

      6144:Lx19xfRz9RzGhN7NLcaI3d4qRo1q0cX2Jje3gsn/2Js3kbC3NDiRzXgbhrUU5OPN:Lx1fFTGjRLca8d1G1q0Dgwsn/as3kW9l

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks