Overview

overview

10

Static

static

Purchase. ...3).exe

windows7-x64

1

Purchase. ...3).exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Purchase. Order & Contract (A-4553).exe
  • Size 709KB
  • Sample220914-qjx1psebbk
  • SHA256 18522fd93f9cb13ee2bb32d6c8090c8c1cddfd0c6a91e284a4ad303e1d6ea048
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooketfhratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • etfh

Decoy

  • 7GZ6EDICLTxRlA==

  • PLtlQESN4qcH

  • Hl1Kaj5k/IbeqjD2BbfAIAg=

  • IGIFzYb9FfCCzV9l

  • i6XHgFSN4qcH

  • OJwysQEOtacTgw==

  • sA02ZDlg/cQuq8OHbjJrZj5hZfBW2hA=

  • 4RW/U8ADLezCD/fcwg==

  • 3B8SJMhHZuG8DjTuj7wqNA==

  • YYEwzTC4Qw4gaIUlH4jx

  • Ues8V/VDLTxRlA==

  • xA958bGoMrQ=

  • YKOQqIa0Qwqq9IR2

  • VoV5nnq7XeY/BZmK2BtWmyiCrQ==

  • O/cKZyK2Wdw386OK9NobskQM

  • k50X1qTOYjVFGrU=

  • +T65goQJnSnD0sqxeMT78ktXVOho4BQ=

  • uJapUOj3EKOK0BjGpf4ePA==

  • QNs2VScpggMYnsh0

  • Z7XOfidNLTxRlA==

Targets

    • Target
      Purchase. Order & Contract (A-4553).exe
    • Size 709KB
    • SHA256 18522fd93f9cb13ee2bb32d6c8090c8c1cddfd0c6a91e284a4ad303e1d6ea048
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooketfhratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks