Overview

overview

10

Static

static

e66c31044e...c5.exe

windows7-x64

10

e66c31044e...c5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e66c31044e1ff0651d907b0309408fc5.exe
  • Size 320KB
  • Sample221108-jcykbsfhap
  • SHA256 68484d62dab0f69fe93fad1f2bb08a0284426ee328efc38b6000f54acf5945f1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookpgntratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • pgnt

Decoy

  • 0WG18LbM4lR9iqMRa4nlBzTb

  • jcfGYzPgZTqFZVO9FV2yIw==

  • laIfrdSC8/4CNg==

  • Q73ilev5GIWuOrAAFV2yIw==

  • Q2u/pMw7pv4sPA==

  • TbqvIUHwlQscPo0HFV2yIw==

  • 8PNWfGPyE8n0IQ==

  • WtgROxXzvY2L

  • PryaRBNjm4eP

  • Y9Hdi06Cry1um9Sj68YAu1o=

  • 3Gulyp7CMQtR78jvLkk=

  • JJ3GasTVTCRQT6Tfz6S6GlI=

  • RnS42bhb9tI0R6UpD6wOxriNxw==

  • he1mi2sOGfzTRGHnuA==

  • eaYjCtjxVjdU5XLRtBMBLKk9quA=

  • k9rTeEqYzzw8WaTfz6S6GlI=

  • 5luVQwe2vJWKEAiMdF4=

  • MGW14L9OVk5Y5TaR6w/DqdhYxXVY

  • mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==

  • y5klhuMbE8n0IQ==

Targets

    • Target
      e66c31044e1ff0651d907b0309408fc5.exe
    • Size 320KB
    • SHA256 68484d62dab0f69fe93fad1f2bb08a0284426ee328efc38b6000f54acf5945f1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookpgntratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Drops startup file

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks