General
-
Target
JaffaCakes118_519f09aa15f946adc5e64fd3bf979393e447632fae6ad2fcfd7b4d070d38cfad
-
Size
394KB
-
Sample
241230-gkkx4azpbm
-
MD5
56e324ac1dd1d55efb512686e9ad080b
-
SHA1
d1c1e8260fa782fc7064dad915fe20bdd9451c0c
-
SHA256
519f09aa15f946adc5e64fd3bf979393e447632fae6ad2fcfd7b4d070d38cfad
-
SHA512
cdeefe5f77410d56745276df56d7f38d4d2c9f6683eedabcf46f2ee7c9438aaa7ed215d3867d3c68fae39aeaa15f74a701112387f1c0e963d7e6403cd5208d51
-
SSDEEP
6144:mDto8fgD9yF0OeBjNyUht57ZMASTU+aV5Q0HCNSKgZLg1jZfb8Ld/ZTeCKc3+s:mDto8ayF1eVV7jSTdC5Q0iN+qoHV
Malware Config
Extracted
formbook
4.1
cr35
tahirsoemantrigroup.com
hashtagstartup.net
guron.biz
donwalin.com
aslanrefinedhomes.com
quitrobo.com
transcriptionservicesindia.com
mooremedications.com
mahounoniwa.com
lowpricepath.com
xinmanxin.com
maliya-interiors.com
rkprops.com
functionsandfoundations.com
thelenditudenews.com
streetlogic.biz
itaste.xyz
protokolavukatlik.com
reformasmende.com
noahsicecream.com
Targets
-
-
Target
e4f478b7cd658cb31bc1192e16ccc1509d552a7229a92fea1a3c6224ee7591a1.bin
-
Size
522KB
-
MD5
a69f3b88a6774d10b9b0bb6c48b196e7
-
SHA1
030e5beded6ba62db2bfc9862a83f5a6c6e29ca6
-
SHA256
e4f478b7cd658cb31bc1192e16ccc1509d552a7229a92fea1a3c6224ee7591a1
-
SHA512
40f4dbe20b5edbc359423fb24639bf0f9caa282b560be8f471ee5e5ea352cba8a4842aa0980a6c62e83607195be5c52b9a81d6cc6b0c22a082a8bb138be25f0a
-
SSDEEP
6144:eY6YpD2FXImLrfqldiQ+vvgFLKBsD1wf9KWj0hxD2Hn8mWFMLppQylXQYdMkfU:1WImHLQEgsowf94xHmZplxQ+H
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook family
-
Formbook payload
-
Suspicious use of SetThreadContext
-