Overview

overview

10

Static

static

SecuriteIn...69.exe

windows7_x64

10

SecuriteIn...69.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.PackedNET.1367.15769.17998
  • Size 636KB
  • Sample220607-cy53zaech6
  • SHA256 802472f04d847b1938c561b991f14db7756e8e137c2bc72a9563752cde1881ab
  • MD5 SHA1 SHA512
Score
10/10
formbookca02ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ca02

Decoy

  • induinsulations.com

  • xianpac.com

  • bodaferygus.site

  • trouville-sur-mer.xyz

  • 4865997.com

  • morkels.com

  • vaperice.com

  • grandmoun.com

  • shriramjewellers.info

  • silkwayexpress.online

  • aerosonde.tech

  • funamebulist.xyz

  • daliaf.online

  • qzhumay.com

  • lineaalignlab.com

  • xn--czru2do2aa267j.xn--czrs0t

  • commercialroofingasaservice.com

  • bgdct.com

  • opulentreverence.com

  • gxs128.com

Targets

    • Target
      SecuriteInfo.com.Trojan.PackedNET.1367.15769.17998
    • Size 636KB
    • SHA256 802472f04d847b1938c561b991f14db7756e8e137c2bc72a9563752cde1881ab
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookca02ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks