Overview

overview

10

Static

static

SecuriteIn...22.exe

windows7-x64

10

SecuriteIn...22.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.Olock.1.31522.16920
  • Size 605KB
  • Sample220725-e5y94segc9
  • SHA256 60f13fad901db97995cd02489a30933d55850bc0aec41d5a072b3380878782ed
  • MD5 SHA1 SHA512
Score
10/10
formbookr05yratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • r05y

Decoy

  • rivella-beauty.com

  • litefimance-vi.com

  • midnightmadness.info

  • newmedstudent.com

  • strongbonestransformation.com

  • yoaza.com

  • darenetstats.com

  • markobrecic.com

  • pecherskikh.com

  • mazsoftware.net

  • contractorseofinder.life

  • vietkieu888.com

  • 24x7account.xyz

  • bestfootball.club

  • interkeypro.com

  • prenuplawyerfinder.life

  • downloadnewsongs.com

  • danielnobra.com

  • waseetdigital.com

  • ozcoo.xyz

Targets

    • Target
      SecuriteInfo.com.Trojan.Olock.1.31522.16920
    • Size 605KB
    • SHA256 60f13fad901db97995cd02489a30933d55850bc0aec41d5a072b3380878782ed
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookr05yratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks