Overview

overview

10

Static

static

SecuriteIn...56.exe

windows7_x64

10

SecuriteIn...56.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.MSIL.GenKryptik.EJVI.1956
  • Size 313KB
  • Sample201109-2eb7jmtyks
  • SHA256 21defefa3b5f49f5dda11d78c015138b8eb4ebf73f78975cf9bd91ace7beee7f
  • MD5 SHA1 SHA512
Score
10/10
formbookevasionratrezer0spywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.mafov.com/tt0/

Decoy

  • suannaidacha.com

  • jp1188.com

  • southernmostcbd.us

  • nuca.ltd

  • 1he6.science

  • cpobill.com

  • bitcoinfeesinfo.com

  • ptdo2f.info

  • kauaispoutinghorn.com

  • salihkoroglu.com

  • thighvoltagerocks.com

  • greatvalleytopsoil.com

  • tallhairy.net

  • wordpressindex.com

  • race615.com

  • craftsmanadmiration.com

  • chinaicewine.net

  • iotacams.com

  • gadgetcucina.com

  • vannes-mobil-home.com

Targets

    • Target
      SecuriteInfo.com.MSIL.GenKryptik.EJVI.1956
    • Size 313KB
    • SHA256 21defefa3b5f49f5dda11d78c015138b8eb4ebf73f78975cf9bd91ace7beee7f
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookevasionratrezer0spywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Formbook Payload

      rat

    • rezer0

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Windows security modification

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks