Overview

overview

10

Static

static

SecuriteIn...41.exe

windows7_x64

10

SecuriteIn...41.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.W32.AIDetectNet.01.15441.1712
  • Size 776KB
  • Sample220523-d38kbsfacq
  • SHA256 c7fbbdd84572a117d47a54168e71b8bd86f0c70198468486f6c3a040e9ecc310
  • MD5 SHA1 SHA512
Score
10/10
formbookq2e2ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • q2e2

Decoy

  • windsortrad.com

  • sesiosam.com

  • moonriiver.network

  • trcmining.net

  • qidumeiyu.com

  • seesouthernafrica.com

  • executivefunctioningmaine.com

  • relaxtantrico.com

  • analaskanoasis.com

  • livesystemperu.com

  • taxisaigon.one

  • toodobem.com

  • dustinmasoncpa.com

  • o0timum.net

  • yaauby.com

  • newarkdeautoservices.com

  • almatjari.com

  • smarttech2.com

  • fuud.place

  • blocky-inu.space

Targets

    • Target
      SecuriteInfo.com.W32.AIDetectNet.01.15441.1712
    • Size 776KB
    • SHA256 c7fbbdd84572a117d47a54168e71b8bd86f0c70198468486f6c3a040e9ecc310
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookq2e2ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks