General

  • Target

    63d45807d6bfb9d7ba0414628c7da25f_JaffaCakes118

  • Size

    893KB

  • Sample

    241020-xqsswswhkk

  • MD5

    63d45807d6bfb9d7ba0414628c7da25f

  • SHA1

    b608e3caf85142ac78be24e72d85b1abd54384c0

  • SHA256

    5e6cd5d639ae3b9425d3e11ded2ba9b054bd28903e7c9ae7b1702a89fc66b953

  • SHA512

    19b615e00ff55288716f854ba49ee69283573fb5695f63e4eb94ec93391b6dcacda9b5714a5de986eaddfb8d1122a454118b0e4785b102432659c8df4fb283d7

  • SSDEEP

    12288:V4h/HK7zmpwMjsmrkjmnGXnu8IBpwYL5cyiq3COst23iVAh6UFQxC5KPkkkzwNu/:9ybAufLXlIL2X6UqxCU8wr

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bkbk

Decoy

myzshouse.com

elimabd.com

iandiphoto.com

k9yhf.com

lalaandthelight.com

spearteam6.com

tdv29mayiskoleji.net

senthamizholi.com

toprooferelpaso.com

homegraphicdesign.com

formas-de-ganar-dinero.online

psgvsfreelive.com

xclusivedispatch.com

qdhizwlti.icu

hananomi24.com

seikobaby.com

cursosinemlinea.com

vintage-transport.com

billings-identify.com

simplepartyplanning.com

Targets

    • Target

      63d45807d6bfb9d7ba0414628c7da25f_JaffaCakes118

    • Size

      893KB

    • MD5

      63d45807d6bfb9d7ba0414628c7da25f

    • SHA1

      b608e3caf85142ac78be24e72d85b1abd54384c0

    • SHA256

      5e6cd5d639ae3b9425d3e11ded2ba9b054bd28903e7c9ae7b1702a89fc66b953

    • SHA512

      19b615e00ff55288716f854ba49ee69283573fb5695f63e4eb94ec93391b6dcacda9b5714a5de986eaddfb8d1122a454118b0e4785b102432659c8df4fb283d7

    • SSDEEP

      12288:V4h/HK7zmpwMjsmrkjmnGXnu8IBpwYL5cyiq3COst23iVAh6UFQxC5KPkkkzwNu/:9ybAufLXlIL2X6UqxCU8wr

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks