Overview

overview

10

Static

static

SecuriteIn...22.exe

windows7-x64

10

SecuriteIn...22.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.W32.AIDetectNet.01.1922.11328

  • Size

    24KB

  • Sample

    220726-1pzftsefap

  • MD5

    1706365b5058cbaa560b23dc297f9585

  • SHA1

    9933c13c7db40fb5ddce9013c42496e66d7a1b5e

  • SHA256

    bf081d3cd1264716c4522f06c6e0294eaa9834c8a06f11d501780d065d7c0135

  • SHA512

    09821d8f4a2eb557d581d107e7e99cdec7738cb2227ebace1d7e9b350496117300cf47a640fc30796b1a80c59ff73f2a6adaa969ab28ede069458fdd877da665

Score
10/10
formbooks4s9ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s4s9

Decoy

qianyuandianshang.com

bernardklein.com

slhomeservices.com

findasaas.com

janellelancaster.xyz

umkpro.site

nr6949.online

mersquare.club

lanariproperties.com

3rdeyefocused.com

giftexpress8260.xyz

hilleleven.xyz

beajod.com

kosazs.online

ishare.team

mb314.com

xjjinxingda.com

ayekooprojectamazing.com

ballsybanter.com

todayshoppingbd.com

Targets

    • Target

      SecuriteInfo.com.W32.AIDetectNet.01.1922.11328

    • Size

      24KB

    • MD5

      1706365b5058cbaa560b23dc297f9585

    • SHA1

      9933c13c7db40fb5ddce9013c42496e66d7a1b5e

    • SHA256

      bf081d3cd1264716c4522f06c6e0294eaa9834c8a06f11d501780d065d7c0135

    • SHA512

      09821d8f4a2eb557d581d107e7e99cdec7738cb2227ebace1d7e9b350496117300cf47a640fc30796b1a80c59ff73f2a6adaa969ab28ede069458fdd877da665

    Score
    10/10
    formbooks4s9ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks