General

  • Target

    23408914cf7f51e436cbfe769a1481dd9f5ed2b6a9ee555439e8d7a75c9a1668

  • Size

    629KB

  • Sample

    240829-cmjetsydjh

  • MD5

    19184b2d5b5984f235caaf734c676659

  • SHA1

    745626ddecf48cf831d514f63e85b2927825f012

  • SHA256

    23408914cf7f51e436cbfe769a1481dd9f5ed2b6a9ee555439e8d7a75c9a1668

  • SHA512

    ada6aabd0cdb7dc4f46f1a75de57877cf8e3f4909032931d7c174bea2c0754e5c7be1e2ff3dfc771c908c358d8011ed772ea73dd25e6de8500a240fa4881d849

  • SSDEEP

    12288:Q5tXj1c2mhfPK7bFI6pScqx+ato2mT4m0wOraDP9OYyJ34DtLhIX63CIgpHfwLGk:Q5vc2mhfi7bGYj2050w7DMIDBebIK4yk

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bi05

Decoy

ollow-the-bit.online

aopho.autos

14ra567dp.autos

48651301.top

ussian-dating-54714.bond

sychology-degree-80838.bond

lytracker.xyz

strology-forest.sbs

swjbcl3.top

ridgenexttechnologies.partners

lroy.sbs

kyscreen.vip

anhit.live

uckyheart.xyz

orddserials.online

hetune.shop

nherited-traits-ant.bond

stanaslot-1.xyz

sychologist-therapy-36914.bond

iandramonami.net

Targets

    • Target

      Updated SOA.exe

    • Size

      1.1MB

    • MD5

      606756c712cb86af9ce0ec454fe92c99

    • SHA1

      7d5000c5d2a1b5b88039994db9dfa17941170c0c

    • SHA256

      594d99b2f426271d893550e00f7931e2b25ec0179e0e52887a77e3ade825b730

    • SHA512

      58354f340dc460275137fb25fd175e4cd52a4dcb40f750007a5ba5c68b13a2f5083a372210f5cfb80cd91c8700f425f7bdb37eecdc626b5feb829ecd43151ba3

    • SSDEEP

      24576:utb20pkaCqT5TBWgNQ7aK3ngGxIKLgh06A:bVg5tQ7ainPxIK35

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks