Overview

overview

10

Static

static

PO 30091.exe

windows7_x64

8

PO 30091.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO 30091.exe

  • Size

    941KB

  • Sample

    200630-ded91fwdpn

  • MD5

    75f65167ca6e0e2a9495c6c014ada606

  • SHA1

    0ed6f49a4333fba64d5bed0037cf8c96b9f6a940

  • SHA256

    06d770563253e518dd207abb9bb30d0ba69b393bc4fa7f1cc9999f0ea1b661f0

  • SHA512

    390c68138807254f44df8ae692921a9530f10ac7a63d3e7db10020734bf6421661d94f994a1fa4fbe0767ed165fac391824dbfe5ce6401115809a81a8eb70862

Score
10/10
formbookevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      PO 30091.exe

    • Size

      941KB

    • MD5

      75f65167ca6e0e2a9495c6c014ada606

    • SHA1

      0ed6f49a4333fba64d5bed0037cf8c96b9f6a940

    • SHA256

      06d770563253e518dd207abb9bb30d0ba69b393bc4fa7f1cc9999f0ea1b661f0

    • SHA512

      390c68138807254f44df8ae692921a9530f10ac7a63d3e7db10020734bf6421661d94f994a1fa4fbe0767ed165fac391824dbfe5ce6401115809a81a8eb70862

    Score
    10/10
    persistencespywareevasiontrojanstealerformbook

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Adds Run entry to policy start application

      persistence

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run entry to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks