Overview

overview

10

Static

static

5

OVERDUE SOA.exe

windows7-x64

10

OVERDUE SOA.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OVERDUE SOA.exe

  • Size

    1.0MB

  • Sample

    241017-h5425s1apl

  • MD5

    ed68b3ba51b50480f55d97bcbbff49da

  • SHA1

    52d3e1c6c578182f9389437910502b11b952b73c

  • SHA256

    d05a51baf2fdfb96870a47d11109b56d6ed815546c839c514d51e9549b7ed04e

  • SHA512

    1f31dba37eb2e46793c7a1954698d556541d1d3184ff14e65310d060da40ae54eb7128dba6f3c5ae179a26ff50636267993fafc6d8470b5509ce0f08b163d453

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLc7QnfMRnbrXMT6OUgxnhfH873pOXT:f3v+7/5QLc8nfCP/gx9H8LMXT

Score
10/10
formbookge07discoveryratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ge07

Decoy

amyard.shop

eloshost.xyz

g18q11a.top

orensic-vendor-735524320.click

ithin-ksvodn.xyz

xhyx.top

elonix-traceglow.pro

cillascrewedsedroth.cfd

wner-nyquh.xyz

reyhazeusa.shop

esmellretaperetotal.cfd

hqm-during.xyz

pipagtxcorrelo.xyz

lray-civil.xyz

apybarameme.xyz

rbuds.shop

hild-fcudh.xyz

rkgexg.top

estwestcottwines.shop

giyztm.xyz

Targets

    • Target

      OVERDUE SOA.exe

    • Size

      1.0MB

    • MD5

      ed68b3ba51b50480f55d97bcbbff49da

    • SHA1

      52d3e1c6c578182f9389437910502b11b952b73c

    • SHA256

      d05a51baf2fdfb96870a47d11109b56d6ed815546c839c514d51e9549b7ed04e

    • SHA512

      1f31dba37eb2e46793c7a1954698d556541d1d3184ff14e65310d060da40ae54eb7128dba6f3c5ae179a26ff50636267993fafc6d8470b5509ce0f08b163d453

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLc7QnfMRnbrXMT6OUgxnhfH873pOXT:f3v+7/5QLc8nfCP/gx9H8LMXT

    Score
    10/10
    formbookge07discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks