Overview

overview

10

Static

static

SecuriteIn...17.exe

windows7_x64

10

SecuriteIn...17.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.VHO.Trojan-PSW.MSIL.Stealer.gen.29117.14213
  • Size 1.0MB
  • Sample220314-e64wzsfahq
  • SHA256 0ba2f6257fb96db81026615bb726f0ede3ea3263f2f79989cbab3f7e3cff97a1
  • MD5 SHA1 SHA512
Score
10/10
formbooka30tratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • a30t

Decoy

  • nietru.icu

  • saudiafc.com

  • 8120567.com

  • grundrow.site

  • tsinversiones.com

  • sytgzx.com

  • hannoschoeck.online

  • cerdacapital.com

  • mastercard-tz.com

  • asupermarkt.store

  • carmobility.online

  • estudiocontablegrados.com

  • downtis.online

  • kingdomdefensesystems.net

  • mw.sbs

  • aiotrip.com

  • decentralcase.com

  • intentionallivingwithmeb.com

  • administratorlope.site

  • uc-un.com

Targets

    • Target
      SecuriteInfo.com.VHO.Trojan-PSW.MSIL.Stealer.gen.29117.14213
    • Size 1.0MB
    • SHA256 0ba2f6257fb96db81026615bb726f0ede3ea3263f2f79989cbab3f7e3cff97a1
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooka30tratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks