General

  • Target

    b745c75293702c7e47b3c1cafea29d65_JaffaCakes118

  • Size

    578KB

  • Sample

    240617-hlnaaaygjb

  • MD5

    b745c75293702c7e47b3c1cafea29d65

  • SHA1

    51b09d18da82e065b48e79c8ca1a53a00219b62c

  • SHA256

    76c5f5e72040b7558eb45e8bf87a551f7ccbd67440b4b7ede1a62e579f69f4de

  • SHA512

    9eb5d3952a60e094fb370b9f479a6c1a7cdc7fe9d0f3ea445c4e76750f829b819e628c396b31343833e03584882ecfc0676ee3a9f92e90b53600cb5cde6ddc26

  • SSDEEP

    12288:tS2a83T3IKwfUu2iKepGZIHsgEUkVyn3TcWItO:tVd3TYr6IpGJgTwynjcW8O

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

el

Decoy

visioncorp.biz

ligriefrelief.com

yadtika.com

tradiscovery.com

merrittandstyle.com

tongcheng.ltd

omclove.com

gronnbygg.com

mragenciesindia.com

14u4.com

thewatchmart.online

urlaubsvideos.net

fmud.ltd

500proxy.online

nisargsangitagrotourism.com

qyygame.com

childhaus.com

431opebet.com

nlpu4n8r41.biz

phoebus-tech.com

Targets

    • Target

      b745c75293702c7e47b3c1cafea29d65_JaffaCakes118

    • Size

      578KB

    • MD5

      b745c75293702c7e47b3c1cafea29d65

    • SHA1

      51b09d18da82e065b48e79c8ca1a53a00219b62c

    • SHA256

      76c5f5e72040b7558eb45e8bf87a551f7ccbd67440b4b7ede1a62e579f69f4de

    • SHA512

      9eb5d3952a60e094fb370b9f479a6c1a7cdc7fe9d0f3ea445c4e76750f829b819e628c396b31343833e03584882ecfc0676ee3a9f92e90b53600cb5cde6ddc26

    • SSDEEP

      12288:tS2a83T3IKwfUu2iKepGZIHsgEUkVyn3TcWItO:tVd3TYr6IpGJgTwynjcW8O

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks