General
-
Target
f306ee8d7bf36075c6c939d1f0b68fe1_JaffaCakes118
-
Size
375KB
-
Sample
241215-jr3slayjcx
-
MD5
f306ee8d7bf36075c6c939d1f0b68fe1
-
SHA1
4ff04989d4357b97754dcb677fa1086c97264f0f
-
SHA256
abb5767c20de75826628990632e63c66c1dde25258d178142cb5bba18057901b
-
SHA512
b66ab91acb1f60127a8a5954b72e66121b45a6da2f141864f2134bfd714da4fe954b992b137a584f717f015178e78f4e850156546523628b0e12d7481682e933
-
SSDEEP
6144:p2QKc6ZJOjI+dutr4KMUCItSzcxZdwGR6dhWs3bbW/LVlY9kxXkfAH7GS3RcQf:p2FXa8SQP2I0zcmkwMom/vefA3hf
Malware Config
Extracted
formbook
4.1
mn9v
whitepqags.com
jyps95.com
lkportoes.com
discotwinks.com
samgyupontheway.info
fourtimeseight.com
fossahosting.net
siakadvm.com
mywebpromotion.com
vysocky.coffee
folkloren.com
underwier.agency
moneymatric.com
romaditalialr.com
unfilteredessence.com
viktorlevi.com
curbo.info
sacrilege.church
charlenemee.com
magatv.net
Targets
-
-
Target
roominglist.exe
-
Size
355KB
-
MD5
0a13ecd06bd1e3f0eab2f9978decb649
-
SHA1
62a914a933c5f25d23ff72c8d1cc937d0f19c0d9
-
SHA256
9f22499224e80938917ef48a3e490372372395cc95a66c9c6df16b64fa384b46
-
SHA512
953309685fc31399d1e746033b519b6ef5ab736465043c79e390b0cef65af95c56891eb81496ca1170ba08ae30a883739cf359a2ed35e5979111f2fbf66ec414
-
SSDEEP
6144:zlag31vYxBBcW7stlZ5WVplicKX1w5zBy2pp7qBR4bXOaEBej/jxzQWVwueoqziD:zlaglvYxBBZ7iZkVpwX1w59BpKR46aEW
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook family
-
Formbook payload
-
Suspicious use of SetThreadContext
-