Overview

overview

10

Static

static

1

FACTURE AVEC TVA.exe

windows7-x64

8

FACTURE AVEC TVA.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FACTURE AVEC TVA.exe

  • Size

    239KB

  • Sample

    221205-3h9pbsgf63

  • MD5

    62e00c3a2ab7efb375892ccf1024a3fd

  • SHA1

    fa3d67066ad84410aeb1618c7f753f1a2896390d

  • SHA256

    02a2a44548d03be7cbc7276014f36ad14b6238694864f0ba481b2303ee387cfb

  • SHA512

    24205b1de8568b89eb2348b2a2cb2c0f3f1bd93e73d6f2e4acb4bfffb69112a8e801f577cdc640413f079852cde6818cb0e712acd09c42a8407254c0debc8ba6

  • SSDEEP

    6144:QBn1zdM7q6aFrQWloaSP/EyNaaEf32j0CmhusYi9BaEZRdFWV:gzdQqFFvz6/pNazU0CmXPZ/FWV

Score
10/10
formbookfqsuratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

fqsu

Decoy

GhfTqaOqC4FsyoQRW/8=

kbPIpd/8k1C6zJz5mYYdK90ZUA==

VIdg/CoNGeYJHA==

KhzoqndOhw1j43z0ew==

wv8mTDcsX2wJN/Q=

MqBgt6S+3BgGKBQHLZy7Ucg=

GyhOb++nZDi39NPK7dbaKapf

pBtD1UoSTdo3eSp9H7OhRqMV0TAuKMU=

WTzTg1w+fP4fMO0oPPM=

NS/tpGdUwkiMwqmgkxoSzjrQATAuKMU=

MnoSdM1hYn4tdwxjB2fX

3EUfH2EJY17mMf4=

V9/wg2yCQruVszm7V+4=

aNL8pZCGYW4Ej2LD

1Bif9VkmdgVfrJqRvl1GtlTZq1M=

9wHIgmB8EOB2uUVcUfk=

1Fdn15qem+fL1qhrY9xdQmAnVg==

Y32ThttYUUr6PsuRmozlNP74RD+uBz7dOQ==

f5HKyoWNAJLM2qjnZlizsvXDKFs=

mRfaGezap6ZyvJqthZvf

Targets

    • Target

      FACTURE AVEC TVA.exe

    • Size

      239KB

    • MD5

      62e00c3a2ab7efb375892ccf1024a3fd

    • SHA1

      fa3d67066ad84410aeb1618c7f753f1a2896390d

    • SHA256

      02a2a44548d03be7cbc7276014f36ad14b6238694864f0ba481b2303ee387cfb

    • SHA512

      24205b1de8568b89eb2348b2a2cb2c0f3f1bd93e73d6f2e4acb4bfffb69112a8e801f577cdc640413f079852cde6818cb0e712acd09c42a8407254c0debc8ba6

    • SSDEEP

      6144:QBn1zdM7q6aFrQWloaSP/EyNaaEf32j0CmhusYi9BaEZRdFWV:gzdQqFFvz6/pNazU0CmXPZ/FWV

    Score
    10/10
    formbookfqsuratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks