Overview

overview

10

Static

static

file.exe

windows7_x64

10

file.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    178KB

  • Sample

    200713-85vmgzkcyj

  • MD5

    269b3771f557dd8baf50335ab7165d81

  • SHA1

    339394ee3109c21c6ee55b4aea36a8ac4c8444a7

  • SHA256

    55fda8fe5169419bcbdfa68e712b378085ddd86638e0f84e50e6b6f43cf19334

  • SHA512

    739abb3c8b81cde39fb1c10da9e911b27b9022ff326775f74f5cfb7912000be8062d50030b5824bba301f97356d877f3435954e9349a4fae9ba167376089d207

Score
10/10
formbookevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      file.exe

    • Size

      178KB

    • MD5

      269b3771f557dd8baf50335ab7165d81

    • SHA1

      339394ee3109c21c6ee55b4aea36a8ac4c8444a7

    • SHA256

      55fda8fe5169419bcbdfa68e712b378085ddd86638e0f84e50e6b6f43cf19334

    • SHA512

      739abb3c8b81cde39fb1c10da9e911b27b9022ff326775f74f5cfb7912000be8062d50030b5824bba301f97356d877f3435954e9349a4fae9ba167376089d207

    Score
    10/10
    trojanspywarestealerformbookpersistenceevasion

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run entry to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks