Overview

overview

10

Static

static

R220917549.exe

windows7_x64

8

R220917549.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    R220917549.exe

  • Size

    923KB

  • Sample

    200713-q5fdbwvy7n

  • MD5

    65e707bd6d53922eed2f27b35bd5355a

  • SHA1

    8e2cb2687357567045584ed5cb36c11cc928f4a4

  • SHA256

    ca2474c82643817c50106479f991ae282b9bb24fde98721dc5f99fe9a5eb3300

  • SHA512

    606f8a9fab4b19fc43ed233f62fcefc3758e1e8fd6358b9fecbd8a3e3a43027ddded905ad2fc185eec7c3e14c1ad563ce007cb35f61797846807757b2ac1447a

Score
10/10
formbookevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      R220917549.exe

    • Size

      923KB

    • MD5

      65e707bd6d53922eed2f27b35bd5355a

    • SHA1

      8e2cb2687357567045584ed5cb36c11cc928f4a4

    • SHA256

      ca2474c82643817c50106479f991ae282b9bb24fde98721dc5f99fe9a5eb3300

    • SHA512

      606f8a9fab4b19fc43ed233f62fcefc3758e1e8fd6358b9fecbd8a3e3a43027ddded905ad2fc185eec7c3e14c1ad563ce007cb35f61797846807757b2ac1447a

    Score
    10/10
    persistencespywareevasiontrojanstealerformbook

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Adds Run entry to policy start application

      persistence

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run entry to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks