Overview

overview

10

Static

static

STATEMENT ...NT.exe

windows7_x64

10

STATEMENT ...NT.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    STATEMENT OF ACCOUNT.exe

  • Size

    332KB

  • Sample

    200713-2vhw41fq3j

  • MD5

    ee68d3b0f702077810bddec50179f75d

  • SHA1

    e84957da433e6df765486f71391edf69f882f50a

  • SHA256

    ee3971f3a905a7bd6126d3d02e0ecaa71bbe41136d3faa0680eec42a4cf20af9

  • SHA512

    957eeeef26c139874fc7983078872b491f534ccc447f98d920ac43d11df7b36ffd3cfa1519fb178d6d103a04237b31f4cd5523cedbea778095a93fc0343cebe4

Score
10/10
formbookevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      STATEMENT OF ACCOUNT.exe

    • Size

      332KB

    • MD5

      ee68d3b0f702077810bddec50179f75d

    • SHA1

      e84957da433e6df765486f71391edf69f882f50a

    • SHA256

      ee3971f3a905a7bd6126d3d02e0ecaa71bbe41136d3faa0680eec42a4cf20af9

    • SHA512

      957eeeef26c139874fc7983078872b491f534ccc447f98d920ac43d11df7b36ffd3cfa1519fb178d6d103a04237b31f4cd5523cedbea778095a93fc0343cebe4

    Score
    10/10
    spywareevasiontrojanstealerformbookpersistence

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run entry to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks