Overview

overview

10

Static

static

1

SecuriteIn...27.exe

windows7_x64

10

SecuriteIn...27.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Dropped.Trojan.GenericKDZ.80240.31980.4427
  • Size 330KB
  • Sample211118-s9ye9shee6
  • SHA256 28b7c509a791caa6448666e9ea27d735770665cce23d0ca8a05404f41db299ec
  • MD5 SHA1 SHA512
Score
10/10
formbookh2b0ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • h2b0

C2

  • http://www.brocoser.com/h2b0/

Decoy

  • coastmortgageloans.com

  • sejt.xyz

  • krisandmeigeni.com

  • personalbias.com

  • cubana-pablo.com

  • nipahvax.com

  • cxyzjsrc.com

  • trttanks.com

  • yoko-by.com

  • sbyidn.net

  • metainstagram.faith

  • katsuyatoken.com

  • trustminingfx.trade

  • xsightvideos.online

  • localemergencies.com

  • 2ab0.com

  • idahofloat.com

  • ourdogdream.com

  • thebestmediaguy.com

  • forthesaltysouls.com

Targets

    • Target
      SecuriteInfo.com.Dropped.Trojan.GenericKDZ.80240.31980.4427
    • Size 330KB
    • SHA256 28b7c509a791caa6448666e9ea27d735770665cce23d0ca8a05404f41db299ec
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookh2b0ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks