General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.8619.13553.exe
-
Size
334KB
-
Sample
221207-g92xxafd7x
-
MD5
c5393296a8272e295bdffd4a85fd1189
-
SHA1
0c1264930c78caccb99990b26d0a78b0e1c997d1
-
SHA256
9746664201bc06916ab09deb02fc11ed4442c46f41135f7f3e87f43d9212f2a9
-
SHA512
b477f136810e6d766d771fa1ad7a5d45e8e719279b504e3de13d30873db39faf527c75c9e9f459b20371cef46d7450b83a790b280b03695192ade046ce415495
-
SSDEEP
6144:JhqA3Yw76hO5FbgjKwfx78wNULuYi2wW5nX1DcbUj9+jv2wjQ2:XV3Yw76hk2KwfywDYZZyCSvB
Malware Config
Extracted
formbook
ermr
ErOK6LFCgNIAlQmH54oaYOL/CN29Z78=
qNSdDhu/PT/1fgafDagiCSZH1SY=
wLpPOAkYS8EABl3pHGc4hNT/Q1sHBrU=
jSxRvptHkeTGl7PT0SEmaZmjqzanuA==
b91oL+2wCcpyhnd6yvF6Pg==
mr81yp1/qqZX
hy7Xsz/PU/LWHMcGL4UYJx9n3A==
KlwrHt1gouPaXaWhoQ==
ng8M320IRJL9Ptw=
8GQbOXuaWxvKnNM=
XndOL7E5sNpVUNty4d/a
rryPBBC8PybYb+2h2MF3FHGL
kEoeyERSVCYO0g==
5/P+SBDby5hO
1fYXc30/h9W7iO17
34X+YKR+wRFE
8ir/X2MlVByh5lQ1ow8=
u9ikm2UMZ7J7hpCYow==
FLI+c3clp1BNDjVAfvC2Dnw=
t21Erq8/r09wAzAJTAH3Ng==
Targets
-
-
Target
SecuriteInfo.com.Win32.PWSX-gen.8619.13553.exe
-
Size
334KB
-
MD5
c5393296a8272e295bdffd4a85fd1189
-
SHA1
0c1264930c78caccb99990b26d0a78b0e1c997d1
-
SHA256
9746664201bc06916ab09deb02fc11ed4442c46f41135f7f3e87f43d9212f2a9
-
SHA512
b477f136810e6d766d771fa1ad7a5d45e8e719279b504e3de13d30873db39faf527c75c9e9f459b20371cef46d7450b83a790b280b03695192ade046ce415495
-
SSDEEP
6144:JhqA3Yw76hO5FbgjKwfx78wNULuYi2wW5nX1DcbUj9+jv2wjQ2:XV3Yw76hk2KwfywDYZZyCSvB
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Suspicious use of SetThreadContext
-