General
-
Target
JaffaCakes118_0fc42384f1e39d784f466de02b83843495cea7e27e7f79f6f7195b88c48e9e3e
-
Size
756KB
-
Sample
241224-qysdrsymat
-
MD5
5265444459acc0536ee2b42f0f3d9b04
-
SHA1
bb04278de1b2ae50d572258266dc7204e6ee1af3
-
SHA256
0fc42384f1e39d784f466de02b83843495cea7e27e7f79f6f7195b88c48e9e3e
-
SHA512
0cfb4463b94864a42a347a6d1d25b7044f8850849bf5c5515d4f0baf2086aa80fe753ae9c7cfd48affd4c2d38299df4f55c3f40af43dd6d62ed0629fa2d59ae7
-
SSDEEP
12288:q/RbNzoSHGj7uvyQgown8g7xMTFPVIqCYDTbvyqZL4DrOOVTi8+H0PHUL4PlgrsI:mN8Smj7SyHown8OCpLDX9p4D3VWMnC4E
Malware Config
Extracted
formbook
4.1
fr35
kantumusic.com
bswpcll.com
retaketomaxx.store
wyrak.site
chrisdc.com
myepower.net
manuscripttomarket.com
arthvisory.com
licvrb.com
iwacufinance.com
subha.info
jdksy.xyz
cdlyu.com
kinisehat.com
solidrockmultimedia.com
goconcepten48.online
efox8.com
elegantnewlook.com
samalaw-sa.com
otcwl.store
Targets
-
-
Target
5b65b6044cab0bcb44717f5e5b9b6793c3870604099dbd4b58531e6ac63cb15d
-
Size
956KB
-
MD5
1d0f9fe2578b015eba100952a39ded18
-
SHA1
304e4a2963f5071360a400545cfca885f8e4bcf4
-
SHA256
5b65b6044cab0bcb44717f5e5b9b6793c3870604099dbd4b58531e6ac63cb15d
-
SHA512
4625f6655c098b011759f3da8027959ea1987e7d50dfd5364e1a297c0a4b641794579d558c0702a60d729438edfc2ce197accd843564c03ed773ce29696ee3b0
-
SSDEEP
12288:VaBXDylqDV1ZWtMhzGZ0GEdtARScCbD4AjM/4Kpi3sXsBqRO6PZXcQ6dhFcgAo:VaBelYYAJPARScCbKQN83ROthzA
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook family
-
Formbook payload
-
Suspicious use of SetThreadContext
-