Overview

overview

10

Static

static

SecuriteIn...26.exe

windows7-x64

10

SecuriteIn...26.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.PWSX-gen.28897.926.exe
  • Size 930KB
  • Sample221024-k7a8ysffe6
  • SHA256 0a92b6b6c9ccba573ca47718bf608715dbc87ad48afc19bf7004d8eb9bf598d0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookxloaderfofgloaderratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • fofg

Decoy

  • FHyydxpFBs0S8b4ZlP7ZEtd/

  • EVaCEKb/cVV9xQ==

  • U9I5lke0IuU7vj5EXus=

  • rXD3AKPV3qUblOUsV41KMfU=

  • PwBSy5z56XNzIvnS3ygsKv0=

  • CQe1BLbSnGXX

  • HuhKjxhLhxqBy2FFz8WoFA==

  • QJymezEoLOFZ1T5EXus=

  • V8r5PAdwuGK2AUARohas

  • b1XV06ANH9s5uj5EXus=

  • 3EiEhwo7Euw2tl8=

  • c2PjK8Izkydy5N8x

  • CXCkYf0m/qPrv8QajKyT6Oo=

  • pHjy+Mk0CqvWBXdCz8WoFA==

  • QjSwr3/j5rAyvz5EXus=

  • +edxANg/sU+k8YFQz8WoFA==

  • tWiQq3rqyl6cTAG9pA==

  • GeAyMQxBUOlDwD5EXus=

  • nQ5eoT2mEKkhDN2DwBek

  • JP5dIbHlrXXR8umDwBek

Targets

    • Target
      SecuriteInfo.com.Win32.PWSX-gen.28897.926.exe
    • Size 930KB
    • SHA256 0a92b6b6c9ccba573ca47718bf608715dbc87ad48afc19bf7004d8eb9bf598d0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookxloaderfofgloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks