Overview

overview

10

Static

static

Remittance advice.exe

windows7_x64

10

Remittance advice.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Remittance advice.exe

  • Size

    832KB

  • Sample

    200710-dm5x3ccpnn

  • MD5

    6b72bf98756a106ce4ffb0d7ef1be954

  • SHA1

    2153b926fbb23eac4af1235f3dc3ff867cbaf174

  • SHA256

    ab12a111885480b3518449ff615d118b0ba908e4f3f0179c8da797c7c815cbfe

  • SHA512

    34e79cbde4f94b779af05677e04e8276bb303d2270c545e43a7ab31a54ab5fa4bafb875fa51c9e24d2de714b4e156bdf062df502d3d86ed2c6e61a0efe7d5e13

Score
10/10
formbookevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      Remittance advice.exe

    • Size

      832KB

    • MD5

      6b72bf98756a106ce4ffb0d7ef1be954

    • SHA1

      2153b926fbb23eac4af1235f3dc3ff867cbaf174

    • SHA256

      ab12a111885480b3518449ff615d118b0ba908e4f3f0179c8da797c7c815cbfe

    • SHA512

      34e79cbde4f94b779af05677e04e8276bb303d2270c545e43a7ab31a54ab5fa4bafb875fa51c9e24d2de714b4e156bdf062df502d3d86ed2c6e61a0efe7d5e13

    Score
    10/10
    spywareevasiontrojanstealerformbookpersistence

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Adds Run entry to policy start application

      persistence

    • Deletes itself

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run entry to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks