General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.12756.6270.exe

  • Size

    822KB

  • Sample

    221205-lnr8ssga22

  • MD5

    e83b0a8fc194633141c951a6861423e4

  • SHA1

    b6ce6d60ff9e63dad304a67eed4a1e3e84271533

  • SHA256

    893f2dfd5758eb6fd8a7c8d9a6e83bc28ef165be2ef52c9a3ef4124f25dcd661

  • SHA512

    84ad26f5efafd38936e0a3c540aaad054215778ebf5d114d03710f1eed3c31ca291e5a307c7ff03fc629947b032b973243c2ad556059b66c119e8676e9a08aea

  • SSDEEP

    12288:BsMcidkg586aWHffM5U/VBzEr2aXDbPmYX/uTSu1VWPbdJ4P9A8TXIFVB:KMZdB5O8fEU/VBXYDLmYWTSoeJuCr

Malware Config

Extracted

Family

formbook

Campaign

w086

Decoy

F6jSz+l9QmYXguG/xUipf/6ixrik

cQZre8twfBVOOJgLenGTGA==

pG5kW2/wqwEOCVxZ

KORXeYwt7wF8J3BR

HL0ZdBMjeHet

TR57b4Yi6wJ8J3BR

fRyK2yaqeDRGHiQTTw==

RwhsqfRxABNZS59wenGTGA==

GuZaY4H4ahcWKjUdVg==

I5C4/Wyz3fglj+o=

Te5QPEu3NjZ0P58LenGTGA==

M9YJLwifZIi9pfnj2Nj/kA6+ZlU=

c/JFdRndG8f/HiQTTw==

nMmcD1UjeHet

QWR7+9Rh8/l8J3BR

9MD+BzOyI6mXtM4w6LMyEA==

WABgaYPqdJzl2TviGbdH

02OexRebqj3+U2kXhQ0=

j17M2R3/fQwFHiQTTw==

dQpReYss5/l8J3BR

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.12756.6270.exe

    • Size

      822KB

    • MD5

      e83b0a8fc194633141c951a6861423e4

    • SHA1

      b6ce6d60ff9e63dad304a67eed4a1e3e84271533

    • SHA256

      893f2dfd5758eb6fd8a7c8d9a6e83bc28ef165be2ef52c9a3ef4124f25dcd661

    • SHA512

      84ad26f5efafd38936e0a3c540aaad054215778ebf5d114d03710f1eed3c31ca291e5a307c7ff03fc629947b032b973243c2ad556059b66c119e8676e9a08aea

    • SSDEEP

      12288:BsMcidkg586aWHffM5U/VBzEr2aXDbPmYX/uTSu1VWPbdJ4P9A8TXIFVB:KMZdB5O8fEU/VBXYDLmYWTSoeJuCr

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks