General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.13734.exe

  • Size

    939KB

  • Sample

    220921-f51zdaaggl

  • MD5

    d69d6dd01955b7b8758ade90eb60368b

  • SHA1

    9e8bac5c47e59eadc5b077edfae58cf7516dfe90

  • SHA256

    7d2e3189c62ed4efa06c9f12895f84a4ff63010409d1031d53b0df185c82f087

  • SHA512

    37a1c7eec5c4452ec117c2e5b5a7de7396bafb3ccd94da3330f5593b3b095382026beb982b7245e4bd0151a9c9f31937a356e73fa851ff9479b1ab4198916ad3

  • SSDEEP

    12288:XOL77AQapF8NJbjCkpbRisO/gJdvo+wuQ3dT78HpD:XOfEWNJbOkvisbNwuAP8HpD

Malware Config

Extracted

Family

formbook

Campaign

etfh

Decoy

7GZ6EDICLTxRlA==

PLtlQESN4qcH

Hl1Kaj5k/IbeqjD2BbfAIAg=

IGIFzYb9FfCCzV9l

i6XHgFSN4qcH

OJwysQEOtacTgw==

sA02ZDlg/cQuq8OHbjJrZj5hZfBW2hA=

4RW/U8ADLezCD/fcwg==

3B8SJMhHZuG8DjTuj7wqNA==

YYEwzTC4Qw4gaIUlH4jx

Ues8V/VDLTxRlA==

xA958bGoMrQ=

YKOQqIa0Qwqq9IR2

VoV5nnq7XeY/BZmK2BtWmyiCrQ==

O/cKZyK2Wdw386OK9NobskQM

k50X1qTOYjVFGrU=

+T65goQJnSnD0sqxeMT78ktXVOho4BQ=

uJapUOj3EKOK0BjGpf4ePA==

QNs2VScpggMYnsh0

Z7XOfidNLTxRlA==

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.13734.exe

    • Size

      939KB

    • MD5

      d69d6dd01955b7b8758ade90eb60368b

    • SHA1

      9e8bac5c47e59eadc5b077edfae58cf7516dfe90

    • SHA256

      7d2e3189c62ed4efa06c9f12895f84a4ff63010409d1031d53b0df185c82f087

    • SHA512

      37a1c7eec5c4452ec117c2e5b5a7de7396bafb3ccd94da3330f5593b3b095382026beb982b7245e4bd0151a9c9f31937a356e73fa851ff9479b1ab4198916ad3

    • SSDEEP

      12288:XOL77AQapF8NJbjCkpbRisO/gJdvo+wuQ3dT78HpD:XOfEWNJbOkvisbNwuAP8HpD

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks