Overview

overview

10

Static

static

Ziraatbank...01.exe

windows7-x64

10

Ziraatbank...01.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ZiraatbankasiSwiftMessaji001.exe
  • Size 1019KB
  • Sample221108-s1ydxaeba5
  • SHA256 4c3d925669944dbdec6649638901b8ccb110c2ff971d8cf558ef05f9980ecf69
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooks5zxratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • s5zx

Decoy

  • wMAY83Xf8pYlwmcLm5HvBdaL

  • CEtcpyGISM/CVFQ5zam3

  • jQE/nMmnXlmcTVQ5zam3

  • kUtRVpN/YY33wLfac81TKg==

  • WxtrRs8s52o/GPsPog==

  • w8LUN0UWABcTD1Hv

  • pCU+Wnk+6/E08im2Xo5y7uea

  • 4o2dnKCJNOgbwud9JfMHrMJuAGI+fg==

  • AbPNtFXXpcoeyWB1WGC/AOiS

  • 5Kbo75EKwcLiArHSoc/SIg==

  • IaICXWtqc2xvU++OXEd+tRitdw==

  • x0M6GKkDC8SPQGd/S61UdfgVZLqVDFg=

  • Y6TEJKsC3IxVJN986uJugqNcN7NO5EU=

  • rltiOepgaw3Mk0Lbt1yoxuA=

  • z94mjMxyFcLUu1Q=

  • xH3F3Hz93BCSMuBtI65JGm+VN3xm

  • +GO142npuuptGPsPog==

  • WX/VsE7R0FTm3Ju2ema/AOiS

  • qam0OKkfCyE6ZKxZtQ==

  • 0ojGr0OMV9khz+4GoA==

Targets

    • Target
      ZiraatbankasiSwiftMessaji001.exe
    • Size 1019KB
    • SHA256 4c3d925669944dbdec6649638901b8ccb110c2ff971d8cf558ef05f9980ecf69
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooks5zxratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks