Overview

overview

10

Static

static

1

4b9fed2912...11.exe

windows7-x64

8

4b9fed2912...11.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b9fed291230a554fb3885d1e3289111

  • Size

    601KB

  • Sample

    221208-a5tx6sgf45

  • MD5

    4b9fed291230a554fb3885d1e3289111

  • SHA1

    5e0ca8ed4ceb45cbae58837ba95219fbb4c00ee2

  • SHA256

    afbdeed783327858a21dbd66af203bcde4415828557de7ec0615ec177b198ccb

  • SHA512

    a32d7bf227a4d51bc636a21b7095dd7e601943a438ffdea2510371b79df7555f5fd0c90b9c0fb95aa396fffd5e34c4f6680415f29b6f342ac944a6e73ad11444

  • SSDEEP

    12288:gQn76IMYGJq57woDY9GE68UPB/Gf+b+PNT0yonFZ4:gQn76RQ7vERUPB+WylGnF2

Score
10/10
formbookelhbratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

elhb

Decoy

BxGzoacPQ3mFBGhbtixjHOm2l30=

dTRqRkWfuBbGMmsPJA==

Pix+zpOG6+Gk

N+3dNZ0ZjOtrRnnj

xUv06VOm45P441HWCmmfSum2l30=

Sx5JuwMfaRrJdK3r

cgU6nPNKa14KC4K40cp4wbkm/KpzfwM=

rV8A2UGJrlbYxa48P40=

Gz3szbYLIYI6l+4=

QU3ru637P+U4itwRQ3n7n2c=

DdkGzbEPU4Fy4h2bZLVXNzz0

QPUo8R5qn9KUnhRRtmVY8/Zp5Xw=

q+EX7juJsVR79msRSnsUxg==

/34eEpvsLS8lw7uom5U=

HEVrEXHlHMlNNp9IlsY+0Q==

KZ/SIWnI7eeog+pwY9uAw+PmmhfjXQ==

Kdn7YMcoXYWjHId+0jhkHem2l30=

R7lnYeAfO1MUHIWyz9c/aoIvHxSvQA==

P7ZYVqmG6+Gk

hlk7m1hdnb0=

Targets

    • Target

      4b9fed291230a554fb3885d1e3289111

    • Size

      601KB

    • MD5

      4b9fed291230a554fb3885d1e3289111

    • SHA1

      5e0ca8ed4ceb45cbae58837ba95219fbb4c00ee2

    • SHA256

      afbdeed783327858a21dbd66af203bcde4415828557de7ec0615ec177b198ccb

    • SHA512

      a32d7bf227a4d51bc636a21b7095dd7e601943a438ffdea2510371b79df7555f5fd0c90b9c0fb95aa396fffd5e34c4f6680415f29b6f342ac944a6e73ad11444

    • SSDEEP

      12288:gQn76IMYGJq57woDY9GE68UPB/Gf+b+PNT0yonFZ4:gQn76RQ7vERUPB+WylGnF2

    Score
    10/10
    formbookelhbratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks