Overview

overview

10

Static

static

kopia płatności.exe

windows7-x64

10

kopia płatności.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    kopia płatności.exe
  • Size 279KB
  • Sample220921-mtds2abgbm
  • SHA256 bdaf2cc27694475beaef6b0945e952e41e3ab6972bae7243b3656c6a87d2bb0e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookdwdpratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • dwdp

Decoy

  • jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=

  • ke1Wv1l26dZZxDikX9dU3s6k8+w=

  • +vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==

  • GHXPhYzwXcKgZwqBb/kejm7rfobj

  • yalW64iE8+aXs70=

  • MD83dBR0KSF4fizgRhAM

  • Xti3uNm2JDWgssPgRhAM

  • X7gYbv5uJhpvjdI0Qg==

  • ydxGznbNJ3tCCLAX4arq4nweMuQ=

  • Ca+fvtST8OBbosPgRhAM

  • kG1QegD8mU/E/hLw1t0=

  • g9FFFjEC5C2IvR/BhbSrpw==

  • PCkpeg38W0aPdg1rav1DFnVASw==

  • vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7

  • G7WYirSZS9EYob8=

  • WbEWaOVIAPlSNNc4LsfL53weMuQ=

  • hnyAvEY4n3rTKS4g5mHKxR0=

  • JN7b0uCqVrQydMl7JNw=

  • XTki/RASDK6BCW0q8sU=

  • DQMBWA9wJyOKqqGSmGHKxR0=

Targets

    • Target
      kopia płatności.exe
    • Size 279KB
    • SHA256 bdaf2cc27694475beaef6b0945e952e41e3ab6972bae7243b3656c6a87d2bb0e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookdwdpratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks