General

  • Target

    57628c79b51d0003b7f109d59d5b947d_JaffaCakes118

  • Size

    360KB

  • Sample

    241018-pffrkswekc

  • MD5

    57628c79b51d0003b7f109d59d5b947d

  • SHA1

    dd1c9a390af61dc89d547d8bcfbec93a16724c5c

  • SHA256

    9994be21618e8807d281389dacb3342921fd50c6eef14168a8309961b2a60b5c

  • SHA512

    21c66fb13aa281ae2e94d1b2fb68e0d07280d18b60ba2ce77ee3920567a82c44c7cb96593a650e31554f9a328f7537181d2f6a3c6297c169f89fee8ef54e4841

  • SSDEEP

    6144:zWFz5Ffcqt5517CiboyQ5OOW5gaGeGrHhUvqKAyDGZBPXESAOvteqLOBUf8q88uD:ziLx3U0lUhUvqKAyCvvESAz48ms2A7B9

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

hx305

Decoy

mascota-pasion.com

babygeniusalquran.com

changchenglian.com

coetech.solutions

knightgrandcommander.online

incalife.online

gbps.world

telartebariloche.com

vereed.net

dublingirlo.com

yubianhuivip6.com

06518787.com

lgqcx.com

best-traffictoupdates.date

zukhyx.info

meydenbauershores.biz

holderdrumstick.com

beazahnimplantatok.live

nadinelisa.com

invirtuos.com

Targets

    • Target

      57628c79b51d0003b7f109d59d5b947d_JaffaCakes118

    • Size

      360KB

    • MD5

      57628c79b51d0003b7f109d59d5b947d

    • SHA1

      dd1c9a390af61dc89d547d8bcfbec93a16724c5c

    • SHA256

      9994be21618e8807d281389dacb3342921fd50c6eef14168a8309961b2a60b5c

    • SHA512

      21c66fb13aa281ae2e94d1b2fb68e0d07280d18b60ba2ce77ee3920567a82c44c7cb96593a650e31554f9a328f7537181d2f6a3c6297c169f89fee8ef54e4841

    • SSDEEP

      6144:zWFz5Ffcqt5517CiboyQ5OOW5gaGeGrHhUvqKAyDGZBPXESAOvteqLOBUf8q88uD:ziLx3U0lUhUvqKAyCvvESAz48ms2A7B9

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks