General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.15485.10619.exe
-
Size
698KB
-
Sample
221124-gd1d7scd64
-
MD5
384c1108356687200fa75e23c9880279
-
SHA1
6b9eb66cedd25665627c095b40d41913447ca60b
-
SHA256
7c470477c32979be016bffc98f861acc089861a6a2ba015aed73d769774370bf
-
SHA512
954821f87770e3013f3c1e35cbd33772c806dc255be206c300314bf659cb41232e82303dfee325165891263796c82ce28eb172e27b405ee77f68412cd1225446
-
SSDEEP
12288:SJRgh/PsZ1DX/VDJtmZo6+qLCON4WI1GtpRZF/R1Y3U7t7E:sRgh/Pomxzmc4XAFc7
Malware Config
Extracted
formbook
m5oe
HdR8hG6r12hBYuHY4zv6YeeFPQ==
tD1V9gswYvgQXEGd
1xKtJ1LdqRYMRMC84U1A
MbhjiWb7Lz8z7KIWl3UyUIJwA6Tb
joVB5Xggy2RtE+odsZg=
TrduAIay6Y3SvoIK20xI
pSna7LOsXXwXT/zz3Iow4g==
QnthmO4Qst5gC3sDoA==
eAirzOOgO7SOCenz3Iow4g==
xg0uSbfLTg==
YWQXwyGRzPEHzGrDFE8CBSE=
ujLnfuXoH9dbgHIK20xI
291v0XsGFrYQXEGd
MRvTd/qMuaHpjCM=
X131fLC6VWX4MsvCb2IPjIfq8wlksWfg
Y9Bur8DbgqFt/Yni86MMCCE=
q6RTBmJkmy5pWTmmCCrvmuCDPw==
mQS26DojT+EQXEGd
sjHQ+Kav2Wx9FeodsZg=
JA24UKnTA5re1LhcQaVo/w==
Targets
-
-
Target
SecuriteInfo.com.Win32.PWSX-gen.15485.10619.exe
-
Size
698KB
-
MD5
384c1108356687200fa75e23c9880279
-
SHA1
6b9eb66cedd25665627c095b40d41913447ca60b
-
SHA256
7c470477c32979be016bffc98f861acc089861a6a2ba015aed73d769774370bf
-
SHA512
954821f87770e3013f3c1e35cbd33772c806dc255be206c300314bf659cb41232e82303dfee325165891263796c82ce28eb172e27b405ee77f68412cd1225446
-
SSDEEP
12288:SJRgh/PsZ1DX/VDJtmZo6+qLCON4WI1GtpRZF/R1Y3U7t7E:sRgh/Pomxzmc4XAFc7
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Suspicious use of SetThreadContext
-