Overview

overview

10

Static

static

ET3B30WFvUox72P.exe

windows7-x64

10

ET3B30WFvUox72P.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ET3B30WFvUox72P.exe

  • Size

    853KB

  • Sample

    221212-mqjvwadh3y

  • MD5

    9c08d86c88ca7a12737a5a78f3a8ad22

  • SHA1

    135bc56ea54a1133055e102a0febef4b796d06cf

  • SHA256

    e121e41abc24cd4a27ec0537679a24a0c8ab76bacbb4e7d636fff4b775a89cbd

  • SHA512

    cd309209ee2577bce854784a1a0bbbf07a81ed22c768f8973d84e4e744e5e623d29d1b34580ec840313cd2713d8fb862fe460ff1953b96b4210a60cd56d8376c

  • SSDEEP

    12288:70wOZQA6qectxWsQvktczPlDxheXw9lE2kSBcLUNfkg586aWHff:74ectxPyztDxheATPkwB5O8f

Score
10/10
formbookbmr1ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

bmr1

Decoy

q05YNsJC4MpYLGAf4A==

6KUzKCvwX0fwzrFQXvlucw==

KA4ZibW1w+hWN5Q=

TfgNq18tIWtsM7h+DexncQ==

zspNqjUKBdJVHTkiMMXJYeF7G53bVvMPoA==

hopQr+b8KzPIbMWvw0Yxir6cyw==

2thmt+17FR/MVsakbM/+w3xGOhopJw==

5gO5gfA6jwna/4FNSPqrvvHyr2A=

kqtr0wr9KaOXVMyDDexncQ==

PNldyz0Boa5cLGAf4A==

Gysor7fqabd0UzTwWp3Zir6cyw==

pMRgV18gtLorB21prX4=

ukpf+vu2u+hWN5Q=

pcS/rO+KmPMj69G9cMHnoSEm59cbIQ==

4fWGzv347bFNDYJeeIHKG5co

WXlRyM2Yn+4Ab1EgRAFHWdGDCzf1

ZPoM+2U1cwMzteOBsHY=

o8jQoNron4sT3A/KomE=

7QX8tTpv/A+YKw==

wFvmV8SY/A+YKw==

Targets

    • Target

      ET3B30WFvUox72P.exe

    • Size

      853KB

    • MD5

      9c08d86c88ca7a12737a5a78f3a8ad22

    • SHA1

      135bc56ea54a1133055e102a0febef4b796d06cf

    • SHA256

      e121e41abc24cd4a27ec0537679a24a0c8ab76bacbb4e7d636fff4b775a89cbd

    • SHA512

      cd309209ee2577bce854784a1a0bbbf07a81ed22c768f8973d84e4e744e5e623d29d1b34580ec840313cd2713d8fb862fe460ff1953b96b4210a60cd56d8376c

    • SSDEEP

      12288:70wOZQA6qectxWsQvktczPlDxheXw9lE2kSBcLUNfkg586aWHff:74ectxPyztDxheATPkwB5O8f

    Score
    10/10
    formbookbmr1ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks