General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe

  • Size

    661KB

  • Sample

    221205-mpdx8sbd85

  • MD5

    b8462af1afb6c95d62624002fcc05726

  • SHA1

    5173feb0360d628a1fd33e00b8860cfe576dff3a

  • SHA256

    672b918c5c82cfed617eeca2ab662854d2e9feef0031f7a72025962f3ee867ca

  • SHA512

    11c25ed18165ffa232828bcbf772d403c16406f85891ed4f6783ba021a9677d9f49628179f8ce9d385974da8ca62054891da25efd6be4092283350f45455636f

  • SSDEEP

    12288:4PuYd+V6b1momPZefNteeJB6s6IvcyOHQ4iPz1r+9Mvp0ThGv2Rg9PuYd+V6b:4PuYd+V6bIomxiNdwuA2F+9MvOmQiPuI

Malware Config

Extracted

Family

formbook

Campaign

n2hm

Decoy

XCeG4IxNKbAl

YzJWbnC+El84nA==

KAJcdmP8yEcO5LXPCFF42Wfb

I+J+xYO95GJQWVU=

GtgxPPv3FmQmhw==

Og9NYF4xEl+j7vGTR93xvg==

506Cg07bsT0G6yK+A96H0h35V+JLkwI=

wAYXFN+pSFIXgQ==

ijzLI/f+FmQmhw==

UfT2PweNm+w8

GQWVw5aZnfF/kS5e

30BKYjua9zcA7gAwsPUngLnjyrBNEgo=

AM65OrmyFmQmhw==

VSlTVxISZ4J/kS5e

GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==

B9H98cUUfX+AWOqiTA==

MxVffWOIoVnM37zrd2sTaOY=

z6bxCgG/mGhR7oDzQA==

pQgSLSRi6AK3M/PdArpX

6rRRsYuSnXx/kS5e

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe

    • Size

      661KB

    • MD5

      b8462af1afb6c95d62624002fcc05726

    • SHA1

      5173feb0360d628a1fd33e00b8860cfe576dff3a

    • SHA256

      672b918c5c82cfed617eeca2ab662854d2e9feef0031f7a72025962f3ee867ca

    • SHA512

      11c25ed18165ffa232828bcbf772d403c16406f85891ed4f6783ba021a9677d9f49628179f8ce9d385974da8ca62054891da25efd6be4092283350f45455636f

    • SSDEEP

      12288:4PuYd+V6b1momPZefNteeJB6s6IvcyOHQ4iPz1r+9Mvp0ThGv2Rg9PuYd+V6b:4PuYd+V6bIomxiNdwuA2F+9MvOmQiPuI

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks