General

  • Target

    e1c0b86c98549ed01e0869700b59b097

  • Size

    290KB

  • Sample

    211021-ldxersaag8

  • MD5

    e1c0b86c98549ed01e0869700b59b097

  • SHA1

    e3a99d5b2559d28e55bb5372cd049202f91baff2

  • SHA256

    87977b60f367dfaaaf3e95f2256eb9b210080cbab4479a53f0299166793d2d66

  • SHA512

    0ddc2be025b06767fc3d4ddbb2ce522408188f7e6ae22a2d7056458180f16f5ab8986bbe404f08f1303f4ce389d06447ab4e4eca62d08e66283838b8278d666a

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n7ak

C2

http://www.kmresults.com/n7ak/

Decoy

modischoolcbse.com

theneverwinter.com

rszkjx-vps-hosting.website

fnihil.com

1pbet.com

nnowzscorrez.com

uaotgvjl.icu

starmapsqatar.com

ekisilani.com

extradeepsheets.com

jam-nins.com

buranly.com

orixentertainment.com

rawtech.energy

myol.guru

utex.club

jiapie.com

wowig.store

wweidlyyl.com

systaskautomation.com

Targets

    • Target

      e1c0b86c98549ed01e0869700b59b097

    • Size

      678KB

    • MD5

      5d0d79406f8e894b3146ecbbf8e27465

    • SHA1

      cdad223f57b289f0a31df86dc254e13325289f6b

    • SHA256

      e36594f316d20c3f0fb948a9c12a0190b872265c7ba49ebb4ffab701f38bbdd9

    • SHA512

      169da8773ca03edbe2ece9614f789d331c6a3732e70d535afb423c133d7c56d90af42409e3fd58d4a5ccf955fce0ff2c400c4d3bfb9af6af110ee69206970c3c

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks