General

  • Target

    bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118

  • Size

    441KB

  • Sample

    240618-n3c4jawgqm

  • MD5

    bbcb0c05b905a651f576be8bf298ce53

  • SHA1

    0e4db794bb8e7f586c6bb86f775dae90704fa5e3

  • SHA256

    97fbf9d45d2a295a9bd6a3666311da6c552993addf93c3e87d9e57c84c39a234

  • SHA512

    2e830e58d831b55d20ea9961023c66ad8e6873e6352b526960cea0802b5243212098a0b48a648d9a563d4603b85ce4c9e3f98d997ad10c04aa11c83fa4eab3a6

  • SSDEEP

    6144:1El2Nt5vw0cmuypyyv0NZ42COv8XmTjkLm8nfsxF7wjimtzZ:1U2pw0eypyq0Qm82vkLnfOOimt

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

h321

Decoy

localchildbirth.info

greatamericanstudentssa.com

eatcoin.net

leikaiclothong.com

lovingmylife.company

akademiatenisaorzel.info

sy-adm.com

cartoons.group

johnandscotto.com

finalize0.com

sxtaibaifen.com

decarttasarim.com

yourboxshipped.net

processandprosper.com

mallorca-nightlive.com

qchj518.com

hc6hlnxeue.biz

lotochain.com

mettlesom.net

labratbrewing.com

Targets

    • Target

      bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118

    • Size

      441KB

    • MD5

      bbcb0c05b905a651f576be8bf298ce53

    • SHA1

      0e4db794bb8e7f586c6bb86f775dae90704fa5e3

    • SHA256

      97fbf9d45d2a295a9bd6a3666311da6c552993addf93c3e87d9e57c84c39a234

    • SHA512

      2e830e58d831b55d20ea9961023c66ad8e6873e6352b526960cea0802b5243212098a0b48a648d9a563d4603b85ce4c9e3f98d997ad10c04aa11c83fa4eab3a6

    • SSDEEP

      6144:1El2Nt5vw0cmuypyyv0NZ42COv8XmTjkLm8nfsxF7wjimtzZ:1U2pw0eypyq0Qm82vkLnfOOimt

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks