Overview
overview
10Static
static
3Soboce.zip
windows7-x64
1Soboce.zip
windows10-2004-x64
1e6b82e1c-a...6d.eml
windows7-x64
5e6b82e1c-a...6d.eml
windows10-2004-x64
3Solicitud ...DF.rar
windows7-x64
3Solicitud ...DF.rar
windows10-2004-x64
3Formulario...DF.exe
windows7-x64
10Formulario...DF.exe
windows10-2004-x64
10email-html-2.html
windows7-x64
1email-html-2.html
windows10-2004-x64
1email-plain-1.txt
windows7-x64
1email-plain-1.txt
windows10-2004-x64
1image001.png
windows7-x64
3image001.png
windows10-2004-x64
3General
-
Target
Soboce.zip
-
Size
774KB
-
Sample
240718-qkalsszepp
-
MD5
b89d4b97b71ac9b918fba69d52181201
-
SHA1
c562530ccb6fb58d5e027e88e9bfd2f848c8d7be
-
SHA256
a2cf16e6c90e082fc5d52f5693d8d433200a10425680ced2f3b1264a2a1d23c3
-
SHA512
b64a68d8eebebb1279d2b7ff348a3b5a1ba21b4ba658de0e2da8e0fa036d032d6c9f651c2840eb1a31d9e28ce46b352dd938f5ed3a070de3ce467a482f334f85
-
SSDEEP
12288:XnS4eAVUyaFJWCJr2zquk4nDEc38ZeHwCqnDDE3miG7+7Hg7zrvfL1b1:XSJ5Rhok4nDEc3UeQDD4M2O7Dn
Static task
static1
Behavioral task
behavioral1
Sample
Soboce.zip
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Soboce.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
e6b82e1c-ac44-4023-8042-08dca5e19c90/4a7406b5-aea0-3461-afa2-c5f3f9b9a06d.eml
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
e6b82e1c-ac44-4023-8042-08dca5e19c90/4a7406b5-aea0-3461-afa2-c5f3f9b9a06d.eml
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.rar
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.rar
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
email-html-2.html
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
email-html-2.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
email-plain-1.txt
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
email-plain-1.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
image001.png
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
image001.png
Resource
win10v2004-20240709-en
Malware Config
Extracted
formbook
4.1
pz12
paucanyes.com
autonwheels.com
cowboysandcaviarbar.com
fitnessengineeredworkouts.com
nuevobajonfavorito.com
dflx8.com
rothability.com
sxybet88.com
onesource.live
brenjitu1904.com
airdrop-zero1labs.com
guangdongqiangzhetc.com
apartments-for-rent-72254.bond
ombak99.lol
qqfoodsolutions.com
kyyzz.com
thepicklematch.com
ainth.com
missorris.com
gabbygomez.com
aromacuppa.com
kaskusbagus.com
zoox1.asia
hemophilia-treatment-41433.bond
meidupro.com
shrisona.com
sekanse.com
marcocostasax.com
loyalbahis356.com
mzmz97.com
ma-google.com
xiangadvanced.site
tuotalogis.com
xcxocef.shop
fidgetbottles.com
shuaninvolved.site
ambientelatino.com
98980901.com
singhbrothersframes.com
pureamyl.com
hgs0713.net
surejobzapp.com
slotgame99.bet
datalakeflow.com
ebehemin.com
vanessasmobilespa.com
317wb.com
motchillssss.top
huesch.net
salesgymshark.shop
mejorcompra99.com
tacubashop.com
jessicaxsimmons.com
roar-stores.com
chalkandthimble.com
84556.vip
luyutuwen.com
siliconcollege.icu
marvowhite.com
gjxuh82y0u3h6.top
e2taop5.top
businessbroadway.com
cripmz.xyz
4hu259.com
jnhdh8827.com
Targets
-
-
Target
Soboce.zip
-
Size
774KB
-
MD5
b89d4b97b71ac9b918fba69d52181201
-
SHA1
c562530ccb6fb58d5e027e88e9bfd2f848c8d7be
-
SHA256
a2cf16e6c90e082fc5d52f5693d8d433200a10425680ced2f3b1264a2a1d23c3
-
SHA512
b64a68d8eebebb1279d2b7ff348a3b5a1ba21b4ba658de0e2da8e0fa036d032d6c9f651c2840eb1a31d9e28ce46b352dd938f5ed3a070de3ce467a482f334f85
-
SSDEEP
12288:XnS4eAVUyaFJWCJr2zquk4nDEc38ZeHwCqnDDE3miG7+7Hg7zrvfL1b1:XSJ5Rhok4nDEc3UeQDD4M2O7Dn
Score1/10 -
-
-
Target
e6b82e1c-ac44-4023-8042-08dca5e19c90/4a7406b5-aea0-3461-afa2-c5f3f9b9a06d.eml
-
Size
1023KB
-
MD5
ac5c17e87832592ff53c4a53a169860f
-
SHA1
fe18b12abfc07caf7f782db3aeacd8037eed3642
-
SHA256
b112d3e0777a406d0703a4e0ad3c6028431a842adb50fe71fe94fa3ea0b61c29
-
SHA512
8827a63ed2d7d521974028e65b8885eb310a6071fb13e5c207b639b957ff02619051d8cc420035e4dbbd17ca862a042dd4cad357a3581ae577d939dc41b342a7
-
SSDEEP
12288:ExmZbBpsi8noZjbg9Hu8jwzLoDp3m6cSQ/Brkv+hruCJ4AQbSEbUlwVZKn3rYK9W:XbBK8jAJwzA3mBSQJrkwWcloK3G8Cc2
Score5/10-
Drops file in System32 directory
-
-
-
Target
Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.001
-
Size
714KB
-
MD5
325b88a0301801c9e04590d2514f6a8e
-
SHA1
79203bbe463d36eb199c2b97732ba638b5764780
-
SHA256
81f6ee45019c48d23ac3265a1ba120d0b34a74e7a51ae3d1c5cecea4db88fe8b
-
SHA512
32163a4ff580ee3ed1f43ba1990e8688cedd5b44c93ca7de138d6fe69eaaacd6712a3c19c260f692ab964db7677f5d8d79c5171785a4fbd7d15e8d6621b69621
-
SSDEEP
12288:lDYQqAva5eO/WQKTYqW/niHEofaPHKDb79xAvRIyWmipePX0xU571Or0X:l2nUO/WQeYqGnilfafKDLgIyWePX0C5n
Score3/10 -
-
-
Target
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
-
Size
829KB
-
MD5
59188cacdad5d6c8e3a0dae4b4a6680d
-
SHA1
82dc5ba9a229e30d96b1eedd05c404a5b4d49288
-
SHA256
4a3155f670006fb3500ca917e16b710f06f2a5f0d1345fb5824f732ec9d34c37
-
SHA512
0e0e43544ec5f21f941b041bcef31bd4372f525c05f8c4c1d91a695b85baecf06c4f62c59be1bce2e374dc7dc672df91678f59cb36c4ffcb6839874a1acc7ad2
-
SSDEEP
24576:fXRv6ZaOmXiJx7E6rSyT6Oiq/sIwieBjsq9Nn:PJ1OGiXoOnTHIVieBjj9Nn
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-
-
-
Target
email-html-2.txt
-
Size
2KB
-
MD5
0551263ae55f7b3ba0b776a1a759cbb1
-
SHA1
4aa41685b7b08f8c2569b0a4a1e20da629b57210
-
SHA256
8e269bee75df1d6bed5a6d2e2c3e6eae6f9432d71a618b094a579abaca4e7e83
-
SHA512
a838d1273c446f4b216bde0d075b21411bf0ebb0465bb6e5d4ddfcc10591f923c4afca36832263e3a64dbb954dc9badf86c535be6f9575b7328bd6da312257f1
Score1/10 -
-
-
Target
email-plain-1.txt
-
Size
572B
-
MD5
b8c2a9f98d58df44d16caedf81f4cbcb
-
SHA1
7a662451f3b89b99256b20f48ebf14e9eb9db5bf
-
SHA256
737e4c9abd884ff9a493d6ba4a9396fc5aed86de42370134900aa58add758c11
-
SHA512
f65a0f32d7eee9c5f6335a14d1ab542f57a3ab631e89cc63283581539921db78b4b354631d1143cfe93f48e486a66ab5d2638e5249a567cacab9100e24710c89
Score1/10 -
-
-
Target
image001.png
-
Size
22KB
-
MD5
f8c38dd4ec2dfc1219beb79e70aa98c6
-
SHA1
2327af22fe3b35a9acce0db251f5b5398f4f01dc
-
SHA256
95dd7b38cdeddc33031055f6bead2fbef087ef6ec9b4efe0a2ec4cb8b45e2d27
-
SHA512
b2d159d654ff537ad66dd19634a1f952b0ef97fe3016abbdfa2c22056535598c91846e671b18a01bd7ec7850303e59f416c1968249c0a682a2f03d6f12b92b35
-
SSDEEP
384:bnlC2Zop86yO/vvcyi4Qw8m6G2Mgxwm7F8pcYZSX3j0N2JW/ikM3xx8UMuM9sCGV:bnlCNByrMSMgxw66ZSS2qs78UMWCGfNv
Score3/10 -