Overview

overview

10

Static

static

5

Updated SOA.exe

windows7-x64

10

Updated SOA.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    4847acf64d3432d3ec137f4c713f34fb1f36c9da8ba7782246dc9502d4a7e00e
  • Size 629KB
  • Sample240901-eavcns1djh
  • SHA256 4847acf64d3432d3ec137f4c713f34fb1f36c9da8ba7782246dc9502d4a7e00e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookbi05discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • bi05

Decoy

  • ollow-the-bit.online

  • aopho.autos

  • 14ra567dp.autos

  • 48651301.top

  • ussian-dating-54714.bond

  • sychology-degree-80838.bond

  • lytracker.xyz

  • strology-forest.sbs

  • swjbcl3.top

  • ridgenexttechnologies.partners

  • lroy.sbs

  • kyscreen.vip

  • anhit.live

  • uckyheart.xyz

  • orddserials.online

  • hetune.shop

  • nherited-traits-ant.bond

  • stanaslot-1.xyz

  • sychologist-therapy-36914.bond

  • iandramonami.net

Targets

    • Target
      Updated SOA.exe
    • Size 1.1MB
    • SHA256 594d99b2f426271d893550e00f7931e2b25ec0179e0e52887a77e3ade825b730
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookbi05discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks