General
-
Target
JaffaCakes118_85cfb27c1f41ca28327555ee08e6bb6c526b74e70ce9bea10c5cec323a803087
-
Size
743KB
-
Sample
241225-gfcqxsyrcs
-
MD5
8948e3313062add867f9ac8d29c54ffa
-
SHA1
6977ec1c988cce6000ca287a3c77a8164ca04cd3
-
SHA256
85cfb27c1f41ca28327555ee08e6bb6c526b74e70ce9bea10c5cec323a803087
-
SHA512
4abf2585e66e3985d40662db97db315e00a3d30c0aea4090e7102411aa3b454938fe35471705fbdf6d9cb4e7d9bd73ff9ce09438b95ba4227c320cf77fa4c3a8
-
SSDEEP
12288:bMNm9oBHll4GnCQ5BZCoys38bgmhwLOFpQaaiom+aRriIzWX9Uop/2:amOLl4GCQjS1HFpNo6IIzOuC/2
Static task
static1
Behavioral task
behavioral1
Sample
LIST.KGR.exe
Resource
win7-20240708-en
Malware Config
Extracted
formbook
4.1
bkbk
myzshouse.com
elimabd.com
iandiphoto.com
k9yhf.com
lalaandthelight.com
spearteam6.com
tdv29mayiskoleji.net
senthamizholi.com
toprooferelpaso.com
homegraphicdesign.com
formas-de-ganar-dinero.online
psgvsfreelive.com
xclusivedispatch.com
qdhizwlti.icu
hananomi24.com
seikobaby.com
cursosinemlinea.com
vintage-transport.com
billings-identify.com
simplepartyplanning.com
haucouture.com
atlerz.com
guiefer.com
chichome65.com
quick360realty.com
pixcelstories.com
mdaestheticspa.com
kansasyouthdental.com
zikarak.art
ourrf.com
vytalcorp.com
t2snatural.com
hotfor.net
peking-global.com
ericrichardkrusenstjerna.com
funkeheatexchangers.com
grey.pro
lovelocalbox.com
playfactle.com
egmpl.com
chuyenlavungnui.online
hanbaoxin.com
rsj-radiosanjoaquinlaserena.com
therednecktribe.com
radiosupermixperu.com
kickfootpain.com
andromedapharm.com
sorbitosderon.com
miriamsmagic.com
finneyindustries.com
cantouhandletheheat.com
runningconseilanglet.com
sanvicentebythesea.com
gao.travel
kaamvashikaran.com
techcreez.xyz
iandepackaging.com
realtyworldplatinum.com
pornmovies.website
shopmpjames.com
izixh.com
xtshuixin.com
831compliance.com
getmauijustice.com
aozhengaodi.com
Targets
-
-
Target
LIST.KGR.exe
-
Size
1006KB
-
MD5
00d7d51c1413e31915bc88c2446fabbb
-
SHA1
1275c5ab9d88eddbd81b551e41a5adf6b37bc91b
-
SHA256
066f116d202e07ae5e071401ab6333a546610277142b1d594d93aec47ba062c0
-
SHA512
7a0cbd6d1268db28fa4a841e0979d1f81ea0a8cd7dd2faa73d6f4c4e792b264e11ea4e8d515a1e1da3ebcff2edcc2f102c5d485da6a55fc196a252c55fc7f70b
-
SSDEEP
12288:cooFTORNvmBwwKovHK7zre0dRl00yqPc7g8heByFfKaaMomSa3riI5WX9lkOEX:+NE20vyJ7FfXoQOI5OMOEX
-
Formbook family
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-