Overview

overview

10

Static

static

SecuriteIn...16.exe

windows7_x64

10

SecuriteIn...16.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.PackedNET.475.29445.3816
  • Size 840KB
  • Sample201204-ha883kdmbs
  • SHA256 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.mommabearmoney.com/et2d/

Decoy

  • wcaconline.com

  • travelbackpackss.com

  • ao-m-nishinomiya.com

  • tilania.com

  • vegbydesign.net

  • mybabysisterscloset.com

  • sanctitude-cuspidated.com

  • russtybeats.com

  • dichvubangchuan.com

  • su-seikatu.info

  • eratosantorini.com

  • ninetofivemama.com

  • delishany.com

  • pawchamamapet.net

  • nissicloud.com

  • strictlyotaku.net

  • kissmanga.pro

  • appalachianfx.com

  • aralending.com

  • forbrighterlife.com

Targets

    • Target
      SecuriteInfo.com.Trojan.PackedNET.475.29445.3816
    • Size 840KB
    • SHA256 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks