Overview

overview

10

Static

static

1

3745a1fe41...c7.exe

windows7-x64

10

3745a1fe41...c7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3745a1fe4166a96e06729c67fd1469c7.exe
  • Size 274KB
  • Sample221027-va526schfn
  • SHA256 e4a8d78909b8d84fcb3d01b91ddeab26615148da704621a3635ac869c9d5dcaf
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookaxe3ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • axe3

Decoy

  • nV63ydJMXMf7memspIpnnVLl3Q==

  • uJ50rs5Y/80AqT79guHh

  • FcsTFQ1xekTgcal8G0P2ZTQ=

  • uLWWVJP++ID3dkoB8g==

  • YyoybGF5Fsa/UH8=

  • Tk4htwkBBfM5ZA==

  • QgJ8vN9f+uCdsD79guHh

  • wmjC9UuSBGyTrY5PAX9t1A==

  • Sw7JEwOKl576ndxw/A==

  • BOqs09Ikjej1BN98ZYtVfSi5xQ==

  • YA5cbH3/4wVAYg==

  • fRWIvatAXM3+t0X9guHh

  • FAbZXq/jFuaEq2YCwQh3b2oE

  • STL+RDTA652/tD/9guHh

  • zgLNcuX32aFB

  • WmgwW1UCJ/9Nc0ofkIhVyQ==

  • jiWgy9ckGh8G+3Q7Rl//NW9ZU7TU

  • JCoawiBkwAkeJOehkNXRCYnj3A==

  • WQDFZvang91P

  • zGrJ4CA2pAhR

Targets

    • Target
      3745a1fe4166a96e06729c67fd1469c7.exe
    • Size 274KB
    • SHA256 e4a8d78909b8d84fcb3d01b91ddeab26615148da704621a3635ac869c9d5dcaf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookaxe3ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks