Overview

overview

10

Static

static

1

HSBC Advice_pdf.exe

windows7-x64

10

HSBC Advice_pdf.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    HSBC Advice_pdf.exe
  • Size 360KB
  • Sample221102-1pbprscae4
  • SHA256 0da49f1594366db1179e9ea93909edb301b41241513a63e5ff7ea57643254b9c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookfigcratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • figc

Decoy

  • 47NW9KXrL+jgHgkaH/SBm7e9+eE=

  • ZiDP2+PQatbRpw==

  • McLVGasjijBUTSo=

  • 7pCDHTcZBQCyFKFSb/4E

  • YwIKwvCFzlnbzcNqDNZ3WH77

  • yFJV/xjTQINSFzg=

  • HJb3EiH2afruNRSvM8UmOTJszaNv

  • vpTsJ8xRpExCgnlkzaoM

  • hUfQlYHe4Qb+DVchQM/mlOM2kjVisoJUMQ==

  • 0URByQED2NCVrO2x5w==

  • 0rjp8oD4ZRKfuI9GPlhwJA==

  • dxYJqqoonh7bHhMqMNIxXJnL5biDg2uv

  • N8ICb2IiuRdOx0dgucigiZ0DBA==

  • xmZ3s1jrZPStPdn5PlhwJA==

  • UxQyYwqi37V3q59to3PU5ZOZtoEGTcin

  • SpBGRe06ITs14S8=

  • spVKc4gldemrMNzf

  • 6IBwrjx2XTs14S8=

  • FOp6CqjQtLdXT25kzaoM

  • P/O46RkpqQ8Uvw==

Targets

    • Target
      HSBC Advice_pdf.exe
    • Size 360KB
    • SHA256 0da49f1594366db1179e9ea93909edb301b41241513a63e5ff7ea57643254b9c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookfigcratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks