General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe

  • Size

    726KB

  • Sample

    221206-lkxzwahe2t

  • MD5

    01b2c837cf80bb287651473932aa1817

  • SHA1

    d2473afbeaa54f4d35b2f8a205f59efc476bc8fa

  • SHA256

    a02026fbb721304677f2b4d6f58d9171d5e411727f6b6c06a8a2ef1792f4c2a8

  • SHA512

    0795a9bf9866da6a102c9779862c06bebd41de6ea4597607062088037c5a3868f12caf0b415ef46fee22d47f06b50fe1b13a32bba6506bb4f290e6e71fe3aaf6

  • SSDEEP

    12288:7wlKAqmomPZefhvhfIkQvP67euBFuJxofaaNSPZb+joGsVaPtqvyuv/7:aomxihNlSPoBFMcaCCZbAtscQF37

Malware Config

Extracted

Family

formbook

Campaign

asdo

Decoy

31/RFVD/FFkpCuo=

LS2evkT1Hf54yJ3A01ZhjLFKSw==

Dw25w8eoM4HRQ9T8YA==

F2rI9TgH1uCf

VOuuxD/qTPifG/QDJ76coQ==

9smUEHwvvAcD3rnTM3IZg7fh

k4RlZq6jXYrfEg==

1+E7QsiGloB8qoio4Oh/

dALS/H0nMg+jCtM1RpZ+

thNv9GMouDLIFvESJ76coQ==

Tc54uifIU66mck2hvrtXnVbp

cINUAYgiqlkpCuo=

ma2AwPyPmpxd2bPRMksak0T7uEg9kA==

RlMlYJ9UpFIz7dg1RpZ+

klG+mNmHrHcFhmZ12SNGhmN+0f6MaMs=

V/nT2VgHD+hito+tBumEzTyVl5g=

0Zto8FjseN7v8MAW6ZkZg7fh

gbGlkddlXYrfEg==

pymXGHouvjhnKg8+qD8bLcY=

VelU01Tk/+CzegtywL4=

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe

    • Size

      726KB

    • MD5

      01b2c837cf80bb287651473932aa1817

    • SHA1

      d2473afbeaa54f4d35b2f8a205f59efc476bc8fa

    • SHA256

      a02026fbb721304677f2b4d6f58d9171d5e411727f6b6c06a8a2ef1792f4c2a8

    • SHA512

      0795a9bf9866da6a102c9779862c06bebd41de6ea4597607062088037c5a3868f12caf0b415ef46fee22d47f06b50fe1b13a32bba6506bb4f290e6e71fe3aaf6

    • SSDEEP

      12288:7wlKAqmomPZefhvhfIkQvP67euBFuJxofaaNSPZb+joGsVaPtqvyuv/7:aomxihNlSPoBFMcaCCZbAtscQF37

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks