Overview

overview

10

Static

static

SecuriteIn...41.exe

windows7_x64

10

SecuriteIn...41.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.PackedNET.405.6036.4041
  • Size 822KB
  • Sample201201-p2y3ls6946
  • SHA256 081e0a3ba699ed2ecdca059eb30de07eff5226c33ae0f5eabb78a6b8577b2685
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.anuschkaleathers.com/zsh/

Decoy

  • golos95.club

  • pickpinz.store

  • surptalb.xyz

  • trippingthemuse.com

  • elizkumas.com

  • thesilverslipper.club

  • musicindustrymag.com

  • newfuzoku.com

  • 2girls1stream.com

  • thefreebands.com

  • ayngaranastro.com

  • urakointiliikeleinonenoy.info

  • downunder-weddings.com

  • tictactechnology.net

  • partnerbudowlany.com

  • slidementality.com

  • estudiosobscuros.com

  • terminalr.com

  • kkrcreations.com

  • ahmclinic.com

Targets

    • Target
      SecuriteInfo.com.Trojan.PackedNET.405.6036.4041
    • Size 822KB
    • SHA256 081e0a3ba699ed2ecdca059eb30de07eff5226c33ae0f5eabb78a6b8577b2685
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks