Overview

overview

10

Static

static

ZiraatBank...11.exe

windows7-x64

10

ZiraatBank...11.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ZiraatBankasi_SwiftMesaji20221111.exe
  • Size 876KB
  • Sample221111-l58l4sed53
  • SHA256 e4432b656843ac5be19e0d5d5e29cc57c855f0ec514b67d93d0e8603567e2ed5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookgo5oratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • go5o

Decoy

  • fS9ce6bj/U7J6Q==

  • KPSUZUVU42J3IaXPjqsA

  • cDR9Sz1n2BN9eTutNa2QNg==

  • POJskuyBUqUdVp2wiI8=

  • t9gcQ5yNydIfrO4=

  • 9oakDnoh0VXC

  • o2Z9n/2iYtDFcJ2wiI8=

  • GLBJZsgVkt3eXZragNJjYiGQ

  • axuNlck5BkA8plrI

  • khk2/+G5g43K

  • Fauoa7FQG6EN2QyITg==

  • fgaVrOb4mLl1KGNUX6jkXCU=

  • HQkML53cm6Ae+zIhRg==

  • TBodPq4E4AJylpZiNa2QNg==

  • wHghSq49EVU54E8mChOvRi5W3cn3ItLVVw==

  • rET2JY8u+TgVpzRtRF54Kw==

  • b0mCXc5pcXHZ9A==

  • QfuIoOgHl9IfrO4=

  • 87fV+WQT5IKlSnTqmb6SbSMctA==

  • E+Yg8EqQKJi9XJKVqrA2i9TO78H53I97

Targets

    • Target
      ZiraatBankasi_SwiftMesaji20221111.exe
    • Size 876KB
    • SHA256 e4432b656843ac5be19e0d5d5e29cc57c855f0ec514b67d93d0e8603567e2ed5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookgo5oratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks