Overview

overview

10

Static

static

SecuriteIn...85.exe

windows7-x64

1

SecuriteIn...85.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe
  • Size 848KB
  • Sample221012-emxzbscdcj
  • SHA256 b673ccbb584d0c5bc0f052883d2235b6eec5a68cb7c8c78c3b6faf6be863de3d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookg28pratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • g28p

Decoy

  • whhmgs.asia

  • wellmedcaredirect.net

  • beggarded.com

  • wtpjiv.site

  • todo-celulares.com

  • parkitny.net

  • 43345.top

  • pro-genie.com

  • cwdxz.com

  • cbc-inc.xyz

  • healthspots.net

  • rulil.top

  • pyramidaudit.solutions

  • k8sb15.live

  • hempaware.report

  • usclink.life

  • stayefs.net

  • 05262.top

  • shop-izakaya-jin.com

  • iccworldcupnews.com

Targets

    • Target
      SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.11363.31485.exe
    • Size 848KB
    • SHA256 b673ccbb584d0c5bc0f052883d2235b6eec5a68cb7c8c78c3b6faf6be863de3d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookg28pratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks