Overview

overview

10

Static

static

SecuriteIn...42.exe

windows7-x64

10

SecuriteIn...42.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.10978.4642.exe
  • Size 850KB
  • Sample221012-emxzbscda8
  • SHA256 62d20f5ce8950e995b0736bb3bafedb34f3b7d95f190b3a0a1592d808f697cac
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookmmtrratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • mmtr

Decoy

  • A2DZqKcj5ytLVZtHJA==

  • fMXPWQG+JWa0S6lZOg==

  • 8kymMDxB6ShVJHxu2gshFtXY9Rw=

  • 1TcOF6WxcdzplqFGcUCNkBY=

  • k3TLhZ+bOG7ahplcPA==

  • K4kL5Aq5abHNS6lZOg==

  • mXDSo9XmxlqYN6psOA==

  • m+RNCVT4shAb

  • G1kzROn+2jCug7F5psQ=

  • qNYsJkWzqwkZ

  • 0BcDQuH0xt4oBh4=

  • pfRW4ZhmRsEiyvP2Mg==

  • Sqgj4eztyCg0Ezwo39iHXQ==

  • bIi2etJbcdUB

  • k2g3gBesND9hUoKOzGaVFKX6IuUaknqH1Q==

  • 8dFDXQPnb4s+sWfhwoqOdgmABBK+YGg=

  • Pn9PmDzelx84EjfdzY0WkiRPz6i4

  • SrUfvOfNO3DMdLvB

  • GFXHQ9NuPdHsxOiU2umGMSiTvQE=

  • Kv9sdrhSbDfMdLvB

Targets

    • Target
      SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.10978.4642.exe
    • Size 850KB
    • SHA256 62d20f5ce8950e995b0736bb3bafedb34f3b7d95f190b3a0a1592d808f697cac
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookmmtrratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks