General

  • Target

    40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe

  • Size

    666KB

  • Sample

    240518-yt8h7ada6w

  • MD5

    40e74255e2f90ce56eb01d773cb44430

  • SHA1

    570e9c660c5a443e3dadd72b96e8c638b29617c5

  • SHA256

    7fbc12b655c7152aa2a5606966d5158e07f559570610f58822f14d5cd531bba0

  • SHA512

    af5c433bfa29c3b1a3e6ad72df92fe5b3fb1b7e1ee55a98d46002eb5ba7ffaee2c7c525786aa9abe4b92cda9838dbf3d20000db71a56b7d969166fbcc86c1d67

  • SSDEEP

    12288:uF0pei36RoX53sdDU7N++kuy6msWk6M87mHytLVx5iOB63ywXlyj5KSpuqhYUqar:uKpp362X53h7YkWkt3SRVx0KOySIE0us

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

38gc

Decoy

fgoz3kry51.asia

vanishingacthairremoval.com

onlinelearningsandbox.com

feluca-egypt.com

goforsourcing.com

hairmadeperfect.com

brockspaydayearners.com

vintagetoj.com

tjandthecampers.com

emkanelajiehes.com

bestundersinkwaterfilter.com

proatta777.com

satuslot.beauty

nicolesbodybutter.com

montecarlogallery.com

homeautomation.one

cx-n1.ink

spennys.casa

gaozgn.cfd

hakajimai.online

Targets

    • Target

      40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe

    • Size

      666KB

    • MD5

      40e74255e2f90ce56eb01d773cb44430

    • SHA1

      570e9c660c5a443e3dadd72b96e8c638b29617c5

    • SHA256

      7fbc12b655c7152aa2a5606966d5158e07f559570610f58822f14d5cd531bba0

    • SHA512

      af5c433bfa29c3b1a3e6ad72df92fe5b3fb1b7e1ee55a98d46002eb5ba7ffaee2c7c525786aa9abe4b92cda9838dbf3d20000db71a56b7d969166fbcc86c1d67

    • SSDEEP

      12288:uF0pei36RoX53sdDU7N++kuy6msWk6M87mHytLVx5iOB63ywXlyj5KSpuqhYUqar:uKpp362X53h7YkWkt3SRVx0KOySIE0us

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks