Overview

overview

10

Static

static

078aa4cb8d...80.exe

windows7-x64

10

078aa4cb8d...80.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    078aa4cb8d8a3ab887ed8539b0d6c580.exe
  • Size 785KB
  • Sample221116-ll2z8aea21
  • SHA256 dbce03f15432cc04590885ae7e6a8397a210ffd4848e792c467dd2329a3a666c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookpgntratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • pgnt

Decoy

  • 0WG18LbM4lR9iqMRa4nlBzTb

  • jcfGYzPgZTqFZVO9FV2yIw==

  • laIfrdSC8/4CNg==

  • Q73ilev5GIWuOrAAFV2yIw==

  • Q2u/pMw7pv4sPA==

  • TbqvIUHwlQscPo0HFV2yIw==

  • 8PNWfGPyE8n0IQ==

  • WtgROxXzvY2L

  • PryaRBNjm4eP

  • Y9Hdi06Cry1um9Sj68YAu1o=

  • 3Gulyp7CMQtR78jvLkk=

  • JJ3GasTVTCRQT6Tfz6S6GlI=

  • RnS42bhb9tI0R6UpD6wOxriNxw==

  • he1mi2sOGfzTRGHnuA==

  • eaYjCtjxVjdU5XLRtBMBLKk9quA=

  • k9rTeEqYzzw8WaTfz6S6GlI=

  • 5luVQwe2vJWKEAiMdF4=

  • MGW14L9OVk5Y5TaR6w/DqdhYxXVY

  • mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==

  • y5klhuMbE8n0IQ==

Targets

    • Target
      078aa4cb8d8a3ab887ed8539b0d6c580.exe
    • Size 785KB
    • SHA256 dbce03f15432cc04590885ae7e6a8397a210ffd4848e792c467dd2329a3a666c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookpgntratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks