Overview

overview

10

Static

static

ZiraatBank...10.exe

windows7-x64

10

ZiraatBank...10.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ZiraatBankasi-SwiftMesaji20221110.exe
  • Size 765KB
  • Sample221110-pp2qeabgcm
  • SHA256 b271ec6f98a0ccdc009eea7a5c99970f9170ff653cb46c428d5bef6c3dcab1a4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookgo5oratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • go5o

Decoy

  • fS9ce6bj/U7J6Q==

  • KPSUZUVU42J3IaXPjqsA

  • cDR9Sz1n2BN9eTutNa2QNg==

  • POJskuyBUqUdVp2wiI8=

  • t9gcQ5yNydIfrO4=

  • 9oakDnoh0VXC

  • o2Z9n/2iYtDFcJ2wiI8=

  • GLBJZsgVkt3eXZragNJjYiGQ

  • axuNlck5BkA8plrI

  • khk2/+G5g43K

  • Fauoa7FQG6EN2QyITg==

  • fgaVrOb4mLl1KGNUX6jkXCU=

  • HQkML53cm6Ae+zIhRg==

  • TBodPq4E4AJylpZiNa2QNg==

  • wHghSq49EVU54E8mChOvRi5W3cn3ItLVVw==

  • rET2JY8u+TgVpzRtRF54Kw==

  • b0mCXc5pcXHZ9A==

  • QfuIoOgHl9IfrO4=

  • 87fV+WQT5IKlSnTqmb6SbSMctA==

  • E+Yg8EqQKJi9XJKVqrA2i9TO78H53I97

Targets

    • Target
      ZiraatBankasi-SwiftMesaji20221110.exe
    • Size 765KB
    • SHA256 b271ec6f98a0ccdc009eea7a5c99970f9170ff653cb46c428d5bef6c3dcab1a4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookgo5oratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks