Overview

overview

10

Static

static

1

TBbnIeshOChdGjx.exe

windows7-x64

10

TBbnIeshOChdGjx.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    TBbnIeshOChdGjx.exe
  • Size 852KB
  • Sample230206-h29s8ace63
  • SHA256 f4a0e79e842eb7a46dc6e5ba3f5cc71c2ea6d600c86eca1fedf63cff8d410fd7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookg44nratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • g44n

Decoy

  • t60gB4YRvsDLttd9HG4=

  • xck8G7COQ+g7VIpX

  • BQQF3mmpLPskhQ==

  • eLWwmzNyK6ee+nF1jDvvkxuSGA==

  • 3tlgNOzw8BBjpNOQMnc=

  • nOpNEJhoU0h+00S9E1YfgA==

  • xcvTpljkjIyEdvhp+VcGFtJC

  • bZxOHr5CtzY4

  • rOD304X0u1DN/m7cbA==

  • Knixl0HJyEOOiNckwk8GFtJC

  • S4JMDRNTUAol

  • Vp9wSwNZSfY7VIpX

  • 0Nf/zlrpmpahnM+tpkYGFtJC

  • joXsuHiBcVp88DHEHMA7

  • yN8i9ppoZYHSSaqqk6NZnQ==

  • 4UFEMfyKhSB4UovzjdabqolwhFtMH1M=

  • d3RiRcXCeR8wlgjEHMA7

  • eMUS8PSBPCe2rPg=

  • LCsR0X328UuSAmlf

  • /keifSXopayqjLt1EWQ=

Targets

    • Target
      TBbnIeshOChdGjx.exe
    • Size 852KB
    • SHA256 f4a0e79e842eb7a46dc6e5ba3f5cc71c2ea6d600c86eca1fedf63cff8d410fd7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookg44nratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks