General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.19493.23000.exe
-
Size
377KB
-
Sample
221202-g8cxdsef51
-
MD5
0948fd22d21033168c4de1e444ad0bfe
-
SHA1
a35c4178b2fa57630c9af5ca9b9debd34fcfc06e
-
SHA256
c0d25313398ba441d25a991187ba627d706b3f108f6f235b28e863648abfbe9b
-
SHA512
6957a08d29c9078d92546e45f62b350557f534e822a45bfbb313b6090d11028eff2c53386e4cfca0a2a721d67e5f233c9ff1aa784246244628670804af639583
-
SSDEEP
6144:PmRqmK4Ls9O5F7t4v81bGDmW4WCViYSCXEpSXUh4jCXVNsZvypaBAINGuy2tJ8:PmR0ws9OKTJV3rNsZ86ARa
Malware Config
Extracted
formbook
ermr
ErOK6LFCgNIAlQmH54oaYOL/CN29Z78=
qNSdDhu/PT/1fgafDagiCSZH1SY=
wLpPOAkYS8EABl3pHGc4hNT/Q1sHBrU=
jSxRvptHkeTGl7PT0SEmaZmjqzanuA==
b91oL+2wCcpyhnd6yvF6Pg==
mr81yp1/qqZX
hy7Xsz/PU/LWHMcGL4UYJx9n3A==
KlwrHt1gouPaXaWhoQ==
ng8M320IRJL9Ptw=
8GQbOXuaWxvKnNM=
XndOL7E5sNpVUNty4d/a
rryPBBC8PybYb+2h2MF3FHGL
kEoeyERSVCYO0g==
5/P+SBDby5hO
1fYXc30/h9W7iO17
34X+YKR+wRFE
8ir/X2MlVByh5lQ1ow8=
u9ikm2UMZ7J7hpCYow==
FLI+c3clp1BNDjVAfvC2Dnw=
t21Erq8/r09wAzAJTAH3Ng==
Targets
-
-
Target
SecuriteInfo.com.Win32.PWSX-gen.19493.23000.exe
-
Size
377KB
-
MD5
0948fd22d21033168c4de1e444ad0bfe
-
SHA1
a35c4178b2fa57630c9af5ca9b9debd34fcfc06e
-
SHA256
c0d25313398ba441d25a991187ba627d706b3f108f6f235b28e863648abfbe9b
-
SHA512
6957a08d29c9078d92546e45f62b350557f534e822a45bfbb313b6090d11028eff2c53386e4cfca0a2a721d67e5f233c9ff1aa784246244628670804af639583
-
SSDEEP
6144:PmRqmK4Ls9O5F7t4v81bGDmW4WCViYSCXEpSXUh4jCXVNsZvypaBAINGuy2tJ8:PmR0ws9OKTJV3rNsZ86ARa
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Suspicious use of SetThreadContext
-