Overview

overview

10

Static

static

SecuriteIn...78.exe

windows7-x64

10

SecuriteIn...78.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe
  • Size 494KB
  • Sample220930-fp9xcaddhj
  • SHA256 f6538d9666e7ae65a8a5e8551808ee946b99b9f8fb189e65e7a06eb4be014e28
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookermrratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • ermr

Decoy

  • ErOK6LFCgNIAlQmH54oaYOL/CN29Z78=

  • qNSdDhu/PT/1fgafDagiCSZH1SY=

  • wLpPOAkYS8EABl3pHGc4hNT/Q1sHBrU=

  • jSxRvptHkeTGl7PT0SEmaZmjqzanuA==

  • b91oL+2wCcpyhnd6yvF6Pg==

  • mr81yp1/qqZX

  • hy7Xsz/PU/LWHMcGL4UYJx9n3A==

  • KlwrHt1gouPaXaWhoQ==

  • ng8M320IRJL9Ptw=

  • 8GQbOXuaWxvKnNM=

  • XndOL7E5sNpVUNty4d/a

  • rryPBBC8PybYb+2h2MF3FHGL

  • kEoeyERSVCYO0g==

  • 5/P+SBDby5hO

  • 1fYXc30/h9W7iO17

  • 34X+YKR+wRFE

  • 8ir/X2MlVByh5lQ1ow8=

  • u9ikm2UMZ7J7hpCYow==

  • FLI+c3clp1BNDjVAfvC2Dnw=

  • t21Erq8/r09wAzAJTAH3Ng==

Targets

    • Target
      SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe
    • Size 494KB
    • SHA256 f6538d9666e7ae65a8a5e8551808ee946b99b9f8fb189e65e7a06eb4be014e28
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookermrratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks