Overview

overview

10

Static

static

SecuriteIn...12.exe

windows7_x64

SecuriteIn...12.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.MachineLearning.Anomalous.95.7087.7112
  • Size 481KB
  • Sample210914-k2rnraadep
  • SHA256 57c14f3c817855d5ba2bfabaade5929697472d2989a8a9bcff46e50ac499a4dc
  • MD5 SHA1 SHA512
Score
10/10
formbookajkiratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ajki

C2

  • http://www.midwestamericanwoman.com/ajki/

Decoy

  • elborivegano.com

  • jacksbookbuddies.com

  • gentciu.com

  • lovetattoonorteguadalix.com

  • dahlkar.com

  • hjobjiihna.club

  • narccar.com

  • noexcuseadventure.com

  • mortongroverealestateinfo.com

  • pursuegoodtimes.com

  • becomearepresentativetoday.com

  • 20bagger.com

  • lowestprices.space

  • qzgay.com

  • thegoenkapost.com

  • glassdooronline.com

  • quantizesoftware.com

  • bayleighmphotography.com

  • hzmm97.com

  • theexoticbox.com

Targets

    • Target
      SecuriteInfo.com.MachineLearning.Anomalous.95.7087.7112
    • Size 481KB
    • SHA256 57c14f3c817855d5ba2bfabaade5929697472d2989a8a9bcff46e50ac499a4dc
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookajkiratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks