Overview

overview

10

Static

static

SecuriteIn...92.exe

windows7-x64

10

SecuriteIn...92.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.8892.exe
  • Size 995KB
  • Sample220917-aebc5scgdr
  • SHA256 7bfd0cbe00b3e14080e2001ec896a53d2f205caa56480a0d760f8460980da76b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookng04ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ng04

Decoy

  • tevimaq.com

  • easterspecialtystore.com

  • smartlever.tech

  • 10312.uk

  • tanjawiharbi.co.uk

  • 471338.com

  • horusventure.com

  • empress-care.com

  • sinrian.com

  • 465951.com

  • aemsti.com

  • nxcourier.com

  • stargatefarms.com

  • lalyquainvestment.com

  • dailysportsadvice.com

  • justlistmoore.com

  • stoneonroll.online

  • tatianakolomiets.com

  • barcodebbm.com

  • protectorship.world

Targets

    • Target
      SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.8892.exe
    • Size 995KB
    • SHA256 7bfd0cbe00b3e14080e2001ec896a53d2f205caa56480a0d760f8460980da76b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookng04ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks