Overview

overview

10

Static

static

Confirmati...92.exe

windows7-x64

10

Confirmati...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Confirmation transfer Ref No_0033463247892.exe

  • Size

    890KB

  • Sample

    221208-l43z8sce91

  • MD5

    03c738a9106a7ba9bad7f4995d52f028

  • SHA1

    204762dbb01579ea39295660d86085591578e0a1

  • SHA256

    aa6874a63646474141e2928b094c5dc15a1fc2ea610ece7ca7f95b80ec856be5

  • SHA512

    d87e427aa177cd28b989e00a4bb382679054009a55021834319ee78bcc181b91d72b639c78fceb7e89584aef552af2fbb7cd90ec76719fb8cc81b18acf4e8c8d

  • SSDEEP

    24576:jmRx3Gdhk0yClxNwArBMQm8i9eXiDdEPf:jmr32hkGFxBlmFezP

Score
10/10
formbookq4k5ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

q4k5

Decoy

ZXN4RZ1db9JIzC7mhQ==

5+KpXZWys/DewpGQbChh6uPT5SNzFQ==

A8YuEKESXrzBhw==

uYH/9+Amwe1ZMkaR

KAusoWlA4I1Rt0P0jA==

AgIBy9IHiq8cdo4h47hB

PsX/0DrQRr+0hQ==

3z4v9UwXBjNTf48h47hB

bySPUkT+SFuT

VsQK5NkDks06l5z+TUG3eetd/twx2Mcjlg==

3+DcnQWuXG84sOphj5LEHIv/hA==

TOZXSDkjSHDoLk/pl2HYpOXJ

q7GGZ9KJrss/oTNwyxI=

2+O/k7y22Qo=

Joatk/qnSoO3q48h47hB

KT1UQcQ9yxWFQzCI

onRBEIHmYIl9XzhAIMtPLFAh5SNzFQ==

a8IY/+/oCDOj2TuM4Ohc

UlIOzyniF1sRnTNwyxI=

8UJiR6gijbvt+exXo7oCvdNV4BE=

Targets

    • Target

      Confirmation transfer Ref No_0033463247892.exe

    • Size

      890KB

    • MD5

      03c738a9106a7ba9bad7f4995d52f028

    • SHA1

      204762dbb01579ea39295660d86085591578e0a1

    • SHA256

      aa6874a63646474141e2928b094c5dc15a1fc2ea610ece7ca7f95b80ec856be5

    • SHA512

      d87e427aa177cd28b989e00a4bb382679054009a55021834319ee78bcc181b91d72b639c78fceb7e89584aef552af2fbb7cd90ec76719fb8cc81b18acf4e8c8d

    • SSDEEP

      24576:jmRx3Gdhk0yClxNwArBMQm8i9eXiDdEPf:jmr32hkGFxBlmFezP

    Score
    10/10
    formbookq4k5ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks