General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.9174.17369.exe

  • Size

    794KB

  • Sample

    221107-vrzayshda4

  • MD5

    577fefe1aeb087c6a32cc4f5419a981a

  • SHA1

    6a8fe3fcd7e19deb22898fdd9595ddbc6efb939b

  • SHA256

    c57a9475d4b8d7811ab189f35fed2acf525f175a77d59a791157d9d52c47b4aa

  • SHA512

    d377b0025f6fd2ef024868ed39facf7203a4fc0506b4e9ed8152bf045253d9d2a57b8a974258473faff90a2b47660b0bfc9b62851d52225ece0123e4148a021c

  • SSDEEP

    12288:dXg6hPKYmFMxemC9G8VcnnjB39/XcFBJyS70kfNws:9g8PKzMoZ9G8qjB3VXc7JOkVws

Malware Config

Extracted

Family

formbook

Campaign

p7fg

Decoy

tYMoF3q831D0aEC4NHHtcl8=

aPEPgLZDsRSCB+RIWTQ=

pqxGyfUYHHgCjldLXAZD4Q==

DpXy2isV0rOfQF8=

FRm9nt1X8hqLaxIIV65dymbqQ8E=

APeyl4TsLxXP04qK

jmbnTU6ZmMSCvDC8Ooa4

bDvPnagKVZAKFEKK3F5e6w==

7cdf2MYiZsNx+hlU00EuY1I=

JFn/bGDIJgMQ1ouI

UlTsY1SAt6ldBkA=

0I2WBzdNT6obuytW1Q==

CclSR6/pCHs61gN2vNMLc1c=

4pXCqvR8xPN0epgMUy8jpB9LnpO0vGugvw==

VyVIrKQBQGwmaBlVVzI=

uoWcGpTsGlMQ1ouI

YGUG55uwuiSy

vowciX211Tb3P5yrGyM=

X1xuWGKzsQaDCORIWTQ=

XGyU9UK/F075DNQAkQaYnZOQ

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.9174.17369.exe

    • Size

      794KB

    • MD5

      577fefe1aeb087c6a32cc4f5419a981a

    • SHA1

      6a8fe3fcd7e19deb22898fdd9595ddbc6efb939b

    • SHA256

      c57a9475d4b8d7811ab189f35fed2acf525f175a77d59a791157d9d52c47b4aa

    • SHA512

      d377b0025f6fd2ef024868ed39facf7203a4fc0506b4e9ed8152bf045253d9d2a57b8a974258473faff90a2b47660b0bfc9b62851d52225ece0123e4148a021c

    • SSDEEP

      12288:dXg6hPKYmFMxemC9G8VcnnjB39/XcFBJyS70kfNws:9g8PKzMoZ9G8qjB3VXc7JOkVws

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks