Overview

overview

10

Static

static

SecuriteIn...60.exe

windows7_x64

10

SecuriteIn...60.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Variant.Strictor.269948.19560.10685
  • Size 615KB
  • Sample220523-d37b9sbfa5
  • SHA256 20270f15d9070f9c2b1d22f0bf2f77ca5ca3dbcf6ccc148b8383a947eb6ebcd5
  • MD5 SHA1 SHA512
Score
10/10
formbookg1s5ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • g1s5

Decoy

  • launch-university.com

  • stf-express.net

  • chatuy.online

  • moldeddoorsupplier.com

  • advertising3.mobi

  • fizn.xyz

  • healingcenter.biz

  • qweasdzxc06.xyz

  • cateyeslook.top

  • chicagobteakingmews.com

  • 767522.com

  • gdsthf.com

  • francepro.tech

  • nycapro.com

  • hyrumdolan.com

  • bedogrow.biz

  • waterloorealestatelawyer.com

  • mira-veranda.net

  • kayrene.com

  • jeffzima.com

Targets

    • Target
      SecuriteInfo.com.Variant.Strictor.269948.19560.10685
    • Size 615KB
    • SHA256 20270f15d9070f9c2b1d22f0bf2f77ca5ca3dbcf6ccc148b8383a947eb6ebcd5
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookg1s5ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks