General
-
Target
JaffaCakes118_1f353c80cb9caf0e679a2dde8eae3e1ad9a230d8f3068eeecc88c42db5679977
-
Size
348KB
-
Sample
241225-z53mraykhr
-
MD5
7c5b7d29667dc931f9dee320efab927e
-
SHA1
b3d8317eb3ea29bdce0355be7af8bede2cfc6381
-
SHA256
1f353c80cb9caf0e679a2dde8eae3e1ad9a230d8f3068eeecc88c42db5679977
-
SHA512
59fd255ab2567c044c4e76c06a9b72d4bfa90e673e6ae80d9842536343c8a0d5dae5609914e54a88d7ec5e980349040688f82fb52cc7f5c74c26b12a78bd57c5
-
SSDEEP
6144:4bmKjS8aATKfHlhOsN2RAO4Q9RtxC8UOYdAJ+hzYGSIqJ3152U:gmoS83TKf3RglrO82AqMGelV
Malware Config
Extracted
formbook
4.1
n6ma
360thrusters.com
activaadvice.xyz
fundmerica-express.com
hnzttx.com
schermerhornfuel.com
westseattledogs.com
sta-lynsvalleybulldogs.com
casualcollars.com
syden-dev.com
ctsquiroz.net
afcareeracademy.com
ofix.online
iworkers.team
nomad-brains.com
wtbgf.com
didemfoods.com
rsqkb.com
statepenrecords.com
virtualbirthdaymagicians.com
bizmarketingsolution.com
Targets
-
-
Target
company business card.exe
-
Size
530KB
-
MD5
5720c1439c56c3e4751d2e54d32119ec
-
SHA1
5282f060debe8835faa37544bbe8218c5260ec8d
-
SHA256
3be235780a8d7a8727a3535e5d236a51c4aff577f89140da4ac58ddf13712aab
-
SHA512
ce826e66df08036b4c7843da2003ae522c5ed6674042cc2ee262380a1ba8459d54a97dcac40b7ad6decbc8397cfcc11957fc82880666407315317f6375bbe0e8
-
SSDEEP
12288:KhQVh9a17gNm5YnXDdx2OjKhNHySntnbjA6hKrHx9fscNj9rmiqwf:KhQVh9FDdx2GKzSStvA60xqcNY2
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook family
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-