General
-
Target
SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
-
Size
552KB
-
Sample
221201-t2jgtaga36
-
MD5
4a20a8cc90118bd227dc8c34451da980
-
SHA1
32516d8174aa9c0a7d31b3d3457783dea0756e06
-
SHA256
567deb123c5d32e9af005cc681340d95fce92e73cf198db892c0d2b9b0e2a38f
-
SHA512
0b14532f3571c52178b4d2fb579895d7e34d9a7bbe8b9a379649ceb610d8c209810809ff70ec62b984adca63f3082f8ba2b7a8ab491e018fbafbf51fb3ac090e
-
SSDEEP
12288:uqz6CeZtZWbkx5THT4aecA29ZP22Sx4sJYsAe/S9jq:p1eZSsJPA29ZPZt4Ab9j
Malware Config
Extracted
formbook
qmpa
IEiN8oqOnNUEkfZd
LWyAr1P5PHPV
tMGP9gYCIc9DKQ==
fWi2stCh2E3DBWuEK612
B3LCCi2JvPxfNA==
NjLnNjX+DDWt/VuEK612
AvK5/JdMDLztPRg=
U+zn2FswDLztPRg=
3bRIXGwsIc9DKQ==
EXmAoj3/7Cyl+VuEK612
1gkKPklP1odxx7c/Zm+L6HeV4g==
1cMaHDg0ypV0vbT2Ibh+/5Cj5xmAVxA=
MSyBdIV+6nFRloTQAwmFklQ=
qilszGJvhMUsHgaUx/MNSKuo6A==
WYKLwmYEij4q2Hy6sOc=
sjII/IyFmORBFPJ2dVjpG0Q=
mTjzaRwZ9OsEkfZd
iL27vFhbX5ECbBIJxvJKbPHFf9M=
5A5Xr0D5PHPV
IpxsaTO4a1/I
Targets
-
-
Target
SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
-
Size
552KB
-
MD5
4a20a8cc90118bd227dc8c34451da980
-
SHA1
32516d8174aa9c0a7d31b3d3457783dea0756e06
-
SHA256
567deb123c5d32e9af005cc681340d95fce92e73cf198db892c0d2b9b0e2a38f
-
SHA512
0b14532f3571c52178b4d2fb579895d7e34d9a7bbe8b9a379649ceb610d8c209810809ff70ec62b984adca63f3082f8ba2b7a8ab491e018fbafbf51fb3ac090e
-
SSDEEP
12288:uqz6CeZtZWbkx5THT4aecA29ZP22Sx4sJYsAe/S9jq:p1eZSsJPA29ZPZt4Ab9j
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Suspicious use of SetThreadContext
-