Overview

overview

10

Static

static

SecuriteIn...11.exe

windows7-x64

10

SecuriteIn...11.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe

  • Size

    837KB

  • Sample

    221206-d4r9qshc67

  • MD5

    b185ab1a2b4309a489c658d5231c3ce8

  • SHA1

    9e09ef7b618d841ba4fc0cc17d0a76a24acde115

  • SHA256

    2106aa8235bc1e05d367bae1e65c50bf8d11c4b4106ceebde0f9307ffcf273c0

  • SHA512

    bd15bc8fbbe262e1831b82841992409a8f9667b209fc9bbf257677b74833a71586ca3d516046f29f656709ef9ae822b6998dcb18cdc80de4630776406b9d1c8e

  • SSDEEP

    12288:9cNhQ3udD6w4toeYw1Ctn4Na7dBNBNjma3gKZ/nXt7virmWhlGLaQYI:WNhHZ6wG7Yw1Ctn4NCF

Score
10/10
formbookgozibmr1bankerisfbratspywarestealertrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

formbook

Campaign

bmr1

Decoy

q05YNsJC4MpYLGAf4A==

6KUzKCvwX0fwzrFQXvlucw==

KA4ZibW1w+hWN5Q=

TfgNq18tIWtsM7h+DexncQ==

zspNqjUKBdJVHTkiMMXJYeF7G53bVvMPoA==

hopQr+b8KzPIbMWvw0Yxir6cyw==

2thmt+17FR/MVsakbM/+w3xGOhopJw==

5gO5gfA6jwna/4FNSPqrvvHyr2A=

kqtr0wr9KaOXVMyDDexncQ==

PNldyz0Boa5cLGAf4A==

Gysor7fqabd0UzTwWp3Zir6cyw==

pMRgV18gtLorB21prX4=

ukpf+vu2u+hWN5Q=

pcS/rO+KmPMj69G9cMHnoSEm59cbIQ==

4fWGzv347bFNDYJeeIHKG5co

WXlRyM2Yn+4Ab1EgRAFHWdGDCzf1

ZPoM+2U1cwMzteOBsHY=

o8jQoNron4sT3A/KomE=

7QX8tTpv/A+YKw==

wFvmV8SY/A+YKw==

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe

    • Size

      837KB

    • MD5

      b185ab1a2b4309a489c658d5231c3ce8

    • SHA1

      9e09ef7b618d841ba4fc0cc17d0a76a24acde115

    • SHA256

      2106aa8235bc1e05d367bae1e65c50bf8d11c4b4106ceebde0f9307ffcf273c0

    • SHA512

      bd15bc8fbbe262e1831b82841992409a8f9667b209fc9bbf257677b74833a71586ca3d516046f29f656709ef9ae822b6998dcb18cdc80de4630776406b9d1c8e

    • SSDEEP

      12288:9cNhQ3udD6w4toeYw1Ctn4Na7dBNBNjma3gKZ/nXt7virmWhlGLaQYI:WNhHZ6wG7Yw1Ctn4NCF

    Score
    10/10
    formbookgozibmr1bankerisfbratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks