General
- Target 29062026_1627_29062026_HSBC_PAYMENT_SWIFT_MT103pdf.gz
- Size 2.2MB
- Sample260629-tx48qabt3m
- SHA256 cf0892fe2c1ba4bf2bcbbf25e67352a5beeeb445597b2b0d58709d2f48f8b52a
Score
10/10
Malware Config
Targets
-
- Target HSBC_PAYMENT_SWIFT_MT103pdf.exe
- Size 3.9MB
- SHA256 1fae7d654695f7c4e0f4bb8a42a4c33137652effc360b998708c6ffcac1380e6
Score10/10-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Accesses Microsoft Outlook profiles
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Suspicious use of SetThreadContext
-
- Target Secur32.dll
- Size 2.1MB
- SHA256 f8a7fd3580f7a79db3be7feb8f1519e38058977a7b50cae698260a487e815475
Score7/10-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1