Overview

overview

10

Static

static

ZiraatBank...22.exe

windows7-x64

1

ZiraatBank...22.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ZiraatBankasi-SwiftMesaji20221122.exe
  • Size 921KB
  • Sample221122-qsyctshf2y
  • SHA256 e1a4191f102a615de1993bfd9381ec31a264cd7f4cfe76b90244a1abf0ab6c7e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookgo5oratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • go5o

Decoy

  • fS9ce6bj/U7J6Q==

  • KPSUZUVU42J3IaXPjqsA

  • cDR9Sz1n2BN9eTutNa2QNg==

  • POJskuyBUqUdVp2wiI8=

  • t9gcQ5yNydIfrO4=

  • 9oakDnoh0VXC

  • o2Z9n/2iYtDFcJ2wiI8=

  • GLBJZsgVkt3eXZragNJjYiGQ

  • axuNlck5BkA8plrI

  • khk2/+G5g43K

  • Fauoa7FQG6EN2QyITg==

  • fgaVrOb4mLl1KGNUX6jkXCU=

  • HQkML53cm6Ae+zIhRg==

  • TBodPq4E4AJylpZiNa2QNg==

  • wHghSq49EVU54E8mChOvRi5W3cn3ItLVVw==

  • rET2JY8u+TgVpzRtRF54Kw==

  • b0mCXc5pcXHZ9A==

  • QfuIoOgHl9IfrO4=

  • 87fV+WQT5IKlSnTqmb6SbSMctA==

  • E+Yg8EqQKJi9XJKVqrA2i9TO78H53I97

Targets

    • Target
      ZiraatBankasi-SwiftMesaji20221122.exe
    • Size 921KB
    • SHA256 e1a4191f102a615de1993bfd9381ec31a264cd7f4cfe76b90244a1abf0ab6c7e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookgo5oratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks