Overview

overview

10

Static

static

a1c968590d...ad.exe

windows7-x64

10

a1c968590d...ad.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1c968590da09ecc1af225059c8b86af05f84465ff069b5327ea9c25172201ad

  • Size

    913KB

  • Sample

    221209-cl9wdsca99

  • MD5

    7a37f59f86f494bd672237e660b3389c

  • SHA1

    811bc7fb1a470ca91165e2450a0fd33e0ee663af

  • SHA256

    a1c968590da09ecc1af225059c8b86af05f84465ff069b5327ea9c25172201ad

  • SHA512

    8217869012dbc876b900d55c971228e9eabe1171b20c75ac7c0129f74229588fd455135e5155bcd1c751c37e8f369bacb7c9a2201646f218a11c6adffd8b644b

  • SSDEEP

    12288:T5zlrGP6oP8qZExrT9sg98NBXdAyq+RDN+3bZY+:PiPn5ZwrpH85A9+RDo

Score
10/10
formbookbwe0ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

bwe0

Decoy

GA8abA96SLI=

RjM/QAsrNyRPlNEjahNMdKXlPtbXpQ==

rOQ4ySihIKVFhRnhZxfZ

iSnyAlGXQBSBwz1C

SYfcQ54ijGWAuQq1UQTE

XRcVgsQIO8FVnvCOiHLvE3k=

K2XLULRJuod6I3dO

S4oH5i5i3+expw==

4hZdto3RgCY9esve1k7T5x9YPw==

fkpgXDuEv2NzvxCcq2AxMnE=

13czFGvtsco1gf8=

ub4KhXCsZ/qnnvYTijN3dA==

WD5IRIcJB51Hfs8grBnldA==

YqxA1LPudXGKyP1FlQ==

MZHXMBdZ8Mf2X3ZjSVY=

7mLLNhchknqdLVbz+6ci4VeD

66OK6kmRv8N6I3dO

+97y8jK5vTnIn8crIwyHnRxv03Kp

PC1PqPJ6573fH0aUnGAxMnE=

3BFlt4nJcA3Inb3TGO02bq++XzWRMVg=

Targets

    • Target

      a1c968590da09ecc1af225059c8b86af05f84465ff069b5327ea9c25172201ad

    • Size

      913KB

    • MD5

      7a37f59f86f494bd672237e660b3389c

    • SHA1

      811bc7fb1a470ca91165e2450a0fd33e0ee663af

    • SHA256

      a1c968590da09ecc1af225059c8b86af05f84465ff069b5327ea9c25172201ad

    • SHA512

      8217869012dbc876b900d55c971228e9eabe1171b20c75ac7c0129f74229588fd455135e5155bcd1c751c37e8f369bacb7c9a2201646f218a11c6adffd8b644b

    • SSDEEP

      12288:T5zlrGP6oP8qZExrT9sg98NBXdAyq+RDN+3bZY+:PiPn5ZwrpH85A9+RDo

    Score
    10/10
    formbookbwe0ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks