General

  • Target

    4847acf64d3432d3ec137f4c713f34fb1f36c9da8ba7782246dc9502d4a7e00e

  • Size

    629KB

  • Sample

    240901-eavcns1djh

  • MD5

    cae4d586cf9972cf64cdf397bcacea44

  • SHA1

    442630ab21aa9d8d54b8319a253fb71c95419a70

  • SHA256

    4847acf64d3432d3ec137f4c713f34fb1f36c9da8ba7782246dc9502d4a7e00e

  • SHA512

    faf468c455f044e4a7f2d32ff8f18f2e04b5a0e02cb561357d03299150e7fc68604f213943819e3e0cfa6610e8455b4dda3ac72f2ac9f90249d5b753b873defd

  • SSDEEP

    12288:oSwrKBORfpPBeg+Lib06SwOTGyrNHUc+4uZFkO/9aNecDef0iFyK9S+6txv3zncT:oSv43bNRORNHveWO/9aTDe98KWd3TV4X

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bi05

Decoy

ollow-the-bit.online

aopho.autos

14ra567dp.autos

48651301.top

ussian-dating-54714.bond

sychology-degree-80838.bond

lytracker.xyz

strology-forest.sbs

swjbcl3.top

ridgenexttechnologies.partners

lroy.sbs

kyscreen.vip

anhit.live

uckyheart.xyz

orddserials.online

hetune.shop

nherited-traits-ant.bond

stanaslot-1.xyz

sychologist-therapy-36914.bond

iandramonami.net

Targets

    • Target

      Updated SOA.exe

    • Size

      1.1MB

    • MD5

      606756c712cb86af9ce0ec454fe92c99

    • SHA1

      7d5000c5d2a1b5b88039994db9dfa17941170c0c

    • SHA256

      594d99b2f426271d893550e00f7931e2b25ec0179e0e52887a77e3ade825b730

    • SHA512

      58354f340dc460275137fb25fd175e4cd52a4dcb40f750007a5ba5c68b13a2f5083a372210f5cfb80cd91c8700f425f7bdb37eecdc626b5feb829ecd43151ba3

    • SSDEEP

      24576:utb20pkaCqT5TBWgNQ7aK3ngGxIKLgh06A:bVg5tQ7ainPxIK35

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks