General
-
Target
JaffaCakes118_ddf35d45c7f1257634905c047c8ddfd40e75dcda9ca39a658c00698e25f3db22
-
Size
590KB
-
Sample
241229-2xt2razker
-
MD5
9110437e204fd3dec75863d5f67ebf04
-
SHA1
089b53ff10af12953acafd4eecf5e4a54cdca798
-
SHA256
ddf35d45c7f1257634905c047c8ddfd40e75dcda9ca39a658c00698e25f3db22
-
SHA512
810750db040ecd33bcbfcc4ef9a9a2e976091ea39718ecf02a9d95b1941cd88657cadd7917f9ada2f2159d963dbef1654ac9830a5b1cb0e08aa777f3e8bc448a
-
SSDEEP
12288:PvQ7i6bfnK+exxeuSioy0VvihvZt8Zx1kifG3S0fi93WcHNcYw:Z0jiMiDqv6hWdkiuC0faTI
Malware Config
Extracted
formbook
4.1
vn3b
rowenglobal.com
abrirumaempresa.com
videosbet.xyz
blackbettyxt.com
trust-red.net
sonyalpharunors.com
shiqichaoji.com
allex-ru.com
totalpowerpc.store
ptocom.com
quantumsai.club
toughcookie.love
nivafitness.com
bioskopmovie21.com
giatsaygiare.com
xiongmaojingxuan.com
zjjly88.com
trampmotorsports.com
pibblekibble.com
mymounntnittanyhealth.com
Targets
-
-
Target
14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd
-
Size
884KB
-
MD5
1b415a56616a9f7c2e37fc2ce570664f
-
SHA1
2e7a5b8378e9a0e5fd7f5a8321af4d128ef2a1a3
-
SHA256
14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd
-
SHA512
e77e25ffeae630cc2413fd969462a7fd019738f2981b4304ab6ba4cc5bb9530db3f1210c5cb90665529f6c25c03f6a63362362a18e6bb801edeccc979a0f711b
-
SSDEEP
12288:c6NsBxnXmu2YWb3Hc3qGuyTM/cTO5t0M5XYMQ2Ds0yW7AWgLmKijL8DP:c6NE2u2YWaDucTO5mM5XHhzy4AsXcP
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook family
-
Formbook payload
-
Suspicious use of SetThreadContext
-