Overview

overview

10

Static

static

1

26b03bc9a5...b8.exe

windows7-x64

10

26b03bc9a5...b8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    26b03bc9a56463548bca6397d586b4b8.exe
  • Size 264KB
  • Sample221111-njvt8seh68
  • SHA256 d4c48b5aefc7225b307e2e8c3f2d158b14fc6b736c83d36dc36a9d7c2e6eec29
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookhenzratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • henz

Decoy

  • IxWMb+jVsoinShuZJzk=

  • TPfKgQZ//oGnKr/J

  • EsK0WxD5kY65XOW1Td/5CxSUpCUytR7M

  • KebSmiCP9p8yUw==

  • HAt/ljkEuqMLHOLCi53Pv8MKX9qk

  • CY4ogZTwJc4vSw==

  • WWDIx5UYUDyepntE0YIAPca3/rI=

  • +Pkr01Lfb2rME7bL

  • S5nyK0p8jS2xdwQ=

  • W/oqvlO57LfkLcLHnQ==

  • zrrwtqkTLwxulm4l8FGopw==

  • AqucYext8bzFbOKthIm8E6gfVkUHxKY=

  • OfnjeDs78+RTcz4OHRl+

  • XKf1wwpZR5hLLjHgmUGOpQ==

  • JMyhSLoJPTCwn5o9zX2d8i1+

  • Wk54MBsDhWSVbnIRkQ==

  • 7aaYR/tOhh9piTw5/KHSRwuK2iqgafw7pQ==

  • hH/EYxN+jC2xdwQ=

  • S0F4ORqDjS2xdwQ=

  • 0o/UwXnuJ+sJp0cOHRl+

Targets

    • Target
      26b03bc9a56463548bca6397d586b4b8.exe
    • Size 264KB
    • SHA256 d4c48b5aefc7225b307e2e8c3f2d158b14fc6b736c83d36dc36a9d7c2e6eec29
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookhenzratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks