General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.21343.8462.exe

  • Size

    1002KB

  • Sample

    221201-s1c3zafh5y

  • MD5

    523dc49d6c29ff597f7fae946ce4ad86

  • SHA1

    33207d35ffe3bc6b19ffc016b06432c43961e791

  • SHA256

    213fbce6c1598d4cd9a54ec4008f6d531f317e81ed125a046ac1812ab8181f53

  • SHA512

    22d7c0c67f299717787653ca00e80843027fa95aae3fb2b890e2b2419f1bd4d6539a0dde889d64171c83f2f06d1d311b6505a973b69b68743ecd1aae71b9b16c

  • SSDEEP

    24576:WTiwAAgEEY4b57gcMOUaRsXsbWWsF6NRW:WTQp17gcfZKsbJsoNR

Malware Config

Extracted

Family

formbook

Campaign

n2hm

Decoy

XCeG4IxNKbAl

YzJWbnC+El84nA==

KAJcdmP8yEcO5LXPCFF42Wfb

I+J+xYO95GJQWVU=

GtgxPPv3FmQmhw==

Og9NYF4xEl+j7vGTR93xvg==

506Cg07bsT0G6yK+A96H0h35V+JLkwI=

wAYXFN+pSFIXgQ==

ijzLI/f+FmQmhw==

UfT2PweNm+w8

GQWVw5aZnfF/kS5e

30BKYjua9zcA7gAwsPUngLnjyrBNEgo=

AM65OrmyFmQmhw==

VSlTVxISZ4J/kS5e

GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==

B9H98cUUfX+AWOqiTA==

MxVffWOIoVnM37zrd2sTaOY=

z6bxCgG/mGhR7oDzQA==

pQgSLSRi6AK3M/PdArpX

6rRRsYuSnXx/kS5e

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.21343.8462.exe

    • Size

      1002KB

    • MD5

      523dc49d6c29ff597f7fae946ce4ad86

    • SHA1

      33207d35ffe3bc6b19ffc016b06432c43961e791

    • SHA256

      213fbce6c1598d4cd9a54ec4008f6d531f317e81ed125a046ac1812ab8181f53

    • SHA512

      22d7c0c67f299717787653ca00e80843027fa95aae3fb2b890e2b2419f1bd4d6539a0dde889d64171c83f2f06d1d311b6505a973b69b68743ecd1aae71b9b16c

    • SSDEEP

      24576:WTiwAAgEEY4b57gcMOUaRsXsbWWsF6NRW:WTQp17gcfZKsbJsoNR

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks