Overview

overview

10

Static

static

December SOA.exe

windows7_x64

10

December SOA.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    December SOA.exe

  • Size

    631KB

  • Sample

    210104-nk9plhnmn2

  • MD5

    eeb02ab3b51a522164e83aafa98494e3

  • SHA1

    c140ae8539c87fd77cba97f725756a71d25ded84

  • SHA256

    383d80ef71e1bd484b6838e3c89eebca3bea49ef0648d3a79564c87aa6ddc00f

  • SHA512

    44a467a7886bd38e776769d1b6f2bcf286d57c2ea0492edfb204d3dcc5c7edae5c5585bad7ae354a1c51db91754ebfbba4ef03e43a6cd56288630228296376b4

Score
10/10
formbookmodiloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.plantbasedtransporter.com/m98/

Decoy

anesbensghair.com

crewsquid.com

thetekapp.com

africaisin.com

dodailyworkout.com

al-sultangate.com

aliciafowens.com

bbluebelt3dwdbuy.com

qjpay.pro

emotionalgun.club

guapasnatural.com

myessentials2020.com

cw-mag.com

petrousd.com

byyter.com

hima-tubusi.com

chapelcouture.com

thehollowcause.site

moskovganteng.com

2024project.com

Targets

    • Target

      December SOA.exe

    • Size

      631KB

    • MD5

      eeb02ab3b51a522164e83aafa98494e3

    • SHA1

      c140ae8539c87fd77cba97f725756a71d25ded84

    • SHA256

      383d80ef71e1bd484b6838e3c89eebca3bea49ef0648d3a79564c87aa6ddc00f

    • SHA512

      44a467a7886bd38e776769d1b6f2bcf286d57c2ea0492edfb204d3dcc5c7edae5c5585bad7ae354a1c51db91754ebfbba4ef03e43a6cd56288630228296376b4

    Score
    10/10
    formbookmodiloaderpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Formbook Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks