General
-
Target
SecuriteInfo.com.Win32.RATX-gen.16128.22392.exe
-
Size
376KB
-
Sample
221205-g9hh9sdd92
-
MD5
b9bba6e66012a79e30ab4e1e1a0f998a
-
SHA1
50adb6889767401d6623ae5a50c9fc961931e73b
-
SHA256
6893a680b837bbeb3544cbd24a0046386ebd972947e132f7e10a1051160caa68
-
SHA512
ded37a7adae8ecb9cf98fa1f1fb7b7d869fc57c12b9ef2c455c3ecb48ef4f3f1cb1c89ee525675c0091cd33c1977713447cddae23049cf726619d1f1682f4f8a
-
SSDEEP
6144:NLUc+1Fs8IWOarxlL3yOZ1bZBKR3FaJAFsbEpD6IdWiXibwdx4x29iuFn0Jcccc/:xz+1C8IWO0FPYYJAOseIdWiXndyxJ
Malware Config
Extracted
formbook
ermr
ErOK6LFCgNIAlQmH54oaYOL/CN29Z78=
qNSdDhu/PT/1fgafDagiCSZH1SY=
wLpPOAkYS8EABl3pHGc4hNT/Q1sHBrU=
jSxRvptHkeTGl7PT0SEmaZmjqzanuA==
b91oL+2wCcpyhnd6yvF6Pg==
mr81yp1/qqZX
hy7Xsz/PU/LWHMcGL4UYJx9n3A==
KlwrHt1gouPaXaWhoQ==
ng8M320IRJL9Ptw=
8GQbOXuaWxvKnNM=
XndOL7E5sNpVUNty4d/a
rryPBBC8PybYb+2h2MF3FHGL
kEoeyERSVCYO0g==
5/P+SBDby5hO
1fYXc30/h9W7iO17
34X+YKR+wRFE
8ir/X2MlVByh5lQ1ow8=
u9ikm2UMZ7J7hpCYow==
FLI+c3clp1BNDjVAfvC2Dnw=
t21Erq8/r09wAzAJTAH3Ng==
Targets
-
-
Target
SecuriteInfo.com.Win32.RATX-gen.16128.22392.exe
-
Size
376KB
-
MD5
b9bba6e66012a79e30ab4e1e1a0f998a
-
SHA1
50adb6889767401d6623ae5a50c9fc961931e73b
-
SHA256
6893a680b837bbeb3544cbd24a0046386ebd972947e132f7e10a1051160caa68
-
SHA512
ded37a7adae8ecb9cf98fa1f1fb7b7d869fc57c12b9ef2c455c3ecb48ef4f3f1cb1c89ee525675c0091cd33c1977713447cddae23049cf726619d1f1682f4f8a
-
SSDEEP
6144:NLUc+1Fs8IWOarxlL3yOZ1bZBKR3FaJAFsbEpD6IdWiXibwdx4x29iuFn0Jcccc/:xz+1C8IWO0FPYYJAOseIdWiXndyxJ
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Suspicious use of SetThreadContext
-