General

  • Target

    SOA.exe

  • Size

    1.1MB

  • Sample

    240920-lsrsts1ajn

  • MD5

    8b22b618c1532585a65a3cfe829018ab

  • SHA1

    1c86d17a59b3630829d579a5b7f2d365c0081a6a

  • SHA256

    9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35

  • SHA512

    cf2cdfcbeb20a63ca1c08cccb9ca154a0854b5835a41b206285feebe3a0bbbea52c0e604d1c4fec1219bfcbe3add48abbb6e228866416085bd04a84e59e813d7

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCTb1lxlb5qUf48Gu4zEBr1+OZ:7JZoQrbTFZY1iaC7n5RvZJ+4

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

c24t

Decoy

ealthbridgeccs.online

ngelicais.art

uktuksu1.sbs

fapoker.asia

hecreature.tech

orenzoplaybest14.xyz

op-smartphones-deal.today

delark.click

7395.asia

otnews.cfd

j16e.xyz

oko.events

fscxb.top

roudtxliberals.vote

asas-br.bond

ourhealthyourlife.shop

fbpd.top

j9u9.xyz

uijiuw.top

aming-chair-37588.bond

Targets

    • Target

      SOA.exe

    • Size

      1.1MB

    • MD5

      8b22b618c1532585a65a3cfe829018ab

    • SHA1

      1c86d17a59b3630829d579a5b7f2d365c0081a6a

    • SHA256

      9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35

    • SHA512

      cf2cdfcbeb20a63ca1c08cccb9ca154a0854b5835a41b206285feebe3a0bbbea52c0e604d1c4fec1219bfcbe3add48abbb6e228866416085bd04a84e59e813d7

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaCTb1lxlb5qUf48Gu4zEBr1+OZ:7JZoQrbTFZY1iaC7n5RvZJ+4

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks