Overview

overview

10

Static

static

ZiraatBank...09.exe

windows7-x64

10

ZiraatBank...09.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ZiraatBankasiSwiftMesaji20221109.exe
  • Size 907KB
  • Sample221109-t912tsaeb8
  • SHA256 fbb79193e65382a20980d8bbf01496be8dd9f1cceb9e253c95e102afd8d52cfc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookgo5oratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • go5o

Decoy

  • fS9ce6bj/U7J6Q==

  • KPSUZUVU42J3IaXPjqsA

  • cDR9Sz1n2BN9eTutNa2QNg==

  • POJskuyBUqUdVp2wiI8=

  • t9gcQ5yNydIfrO4=

  • 9oakDnoh0VXC

  • o2Z9n/2iYtDFcJ2wiI8=

  • GLBJZsgVkt3eXZragNJjYiGQ

  • axuNlck5BkA8plrI

  • khk2/+G5g43K

  • Fauoa7FQG6EN2QyITg==

  • fgaVrOb4mLl1KGNUX6jkXCU=

  • HQkML53cm6Ae+zIhRg==

  • TBodPq4E4AJylpZiNa2QNg==

  • wHghSq49EVU54E8mChOvRi5W3cn3ItLVVw==

  • rET2JY8u+TgVpzRtRF54Kw==

  • b0mCXc5pcXHZ9A==

  • QfuIoOgHl9IfrO4=

  • 87fV+WQT5IKlSnTqmb6SbSMctA==

  • E+Yg8EqQKJi9XJKVqrA2i9TO78H53I97

Targets

    • Target
      ZiraatBankasiSwiftMesaji20221109.exe
    • Size 907KB
    • SHA256 fbb79193e65382a20980d8bbf01496be8dd9f1cceb9e253c95e102afd8d52cfc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookgo5oratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks