General
-
Target
1890b1885ef644775e1f89adfdfe7c67_JaffaCakes118
-
Size
962KB
-
Sample
240628-dmex3s1aqq
-
MD5
1890b1885ef644775e1f89adfdfe7c67
-
SHA1
b04297e721e9f61b70daaa07ff67bf46e51a4362
-
SHA256
94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a
-
SHA512
4240b80f2b3aaa24bd9356df9a4c75e3bb1551fe4a9730d4e6aeb9a1703f31676fc3ec63f314d1b8e911b30cb4dbbcb708134fe9e573299d70e77821ba112fab
-
SSDEEP
12288:B2vFitrWZLYS4cxSm1wlQba5oGogT0qVSUGeQ40Lv15cE1boHKd6q:B2vFitKZkr0STQba5oRgvQZd1kqd6
Malware Config
Extracted
formbook
4.1
wtb
cocorodance.com
emorytxinsurance.com
issuerevaluation.com
slingshotsmd.com
copperheadcsm.com
datnamgrouphr.com
pdrallstar.com
alphagraphicsdesigner.com
cornerstonerecruitmentasia.com
iowie.com
raminson-mg.com
previem.com
bet-oren.com
frenchyoutlet.com
muqiangzhan.com
kyokids.com
risha-mint.online
albeda.online
xn--v8jwa9c.com
fluffygirlactive.com
Targets
-
-
Target
1890b1885ef644775e1f89adfdfe7c67_JaffaCakes118
-
Size
962KB
-
MD5
1890b1885ef644775e1f89adfdfe7c67
-
SHA1
b04297e721e9f61b70daaa07ff67bf46e51a4362
-
SHA256
94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a
-
SHA512
4240b80f2b3aaa24bd9356df9a4c75e3bb1551fe4a9730d4e6aeb9a1703f31676fc3ec63f314d1b8e911b30cb4dbbcb708134fe9e573299d70e77821ba112fab
-
SSDEEP
12288:B2vFitrWZLYS4cxSm1wlQba5oGogT0qVSUGeQ40Lv15cE1boHKd6q:B2vFitKZkr0STQba5oRgvQZd1kqd6
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-