Overview

overview

10

Static

static

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmp
  • Size 1.0MB
  • Sample221014-xp84gsebgp
  • SHA256 1046455f39dbe56dc8cc160ebc53b5b32315021af4a871c06235a5257e02f123
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooks8gwratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • s8gw

Decoy

  • b/iFndOEL2rKvw==

  • HK7quAepCJH6CkNgpH2cDYx1

  • YEayMA+cR1WQ0Qw/lQ==

  • kPVNVkAC6pEPHVFQnzCxsA==

  • yLE1wrE7kf1KRGRm5a95qQ==

  • D6ktQZWoaOJGopmOlg==

  • 98rmMok6y5e47YvCCMQNPaqM6qf+7PsEAQ==

  • 7Po3fdN1NNtop0X5Ryv9PnUrSLQ=

  • +vk1DU92V465rf1+gFhdWMFoAsAY

  • AuhZ6jw45aHmPdzGVilx

  • /9ln8smKekiYzqePkA==

  • 7+gsdtTlpqcSL0/GVilx

  • 6pXLEOumjAfvK8Y=

  • inT5kfC0FBmcw/hw7NYua819

  • wb/qKZCjfrEiKFz9Vyn9chrZxA==

  • Pil1K4a6ruUXJ2fPD5qXo+2pNMn5VdCREA==

  • mxo3/mBm1hMSWd8=

  • 8ltzwIsdiPpJXbK30JecDYx1

  • BmrK2y9G+VyimqzrK9YtmYY=

  • jPP9Q/IqWt3JQSZtvqI1jb9oAsAY

Targets

    • Target
      tmp
    • Size 1.0MB
    • SHA256 1046455f39dbe56dc8cc160ebc53b5b32315021af4a871c06235a5257e02f123
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooks8gwratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks