Overview

overview

10

Static

static

SecuriteIn...40.exe

windows7_x64

10

SecuriteIn...40.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.BehavesLike.Win32.Fareit.bc.23992.24340
  • Size 711KB
  • Sample210923-pexnpsecap
  • SHA256 931ad1cf5a3299e9dde40176dcacfb31c152d03764ebdf70d2aaa7493c94f11a
  • MD5 SHA1 SHA512
Score
10/10
formbookcmsrratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • cmsr

C2

  • http://www.odysseysailingsantorini.com/cmsr/

Decoy

  • dahlia-dolls.com

  • iamawife.com

  • gardunomx.com

  • roweelitetrucking.com

  • asapvk.com

  • strategieslimited.com

  • healthyweathorganics.com

  • wedding-gallery.net

  • fastoffer.online

  • biolab33.cloud

  • los40delocta.com

  • charliepaton.com

  • jenpaddock.com

  • zzmweb.com

  • poetarts.com

  • techwork4u.com

  • tracylynpropp.com

  • rkbodyfit.site

  • migaleriapanama.com

  • cosmostco.com

Targets

    • Target
      SecuriteInfo.com.BehavesLike.Win32.Fareit.bc.23992.24340
    • Size 711KB
    • SHA256 931ad1cf5a3299e9dde40176dcacfb31c152d03764ebdf70d2aaa7493c94f11a
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookcmsrratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks