Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

SecuriteIn...70.exe

windows7-x64

10

SecuriteIn...70.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe

  • Size

    823KB

  • Sample

    221027-qkhbmsccfl

  • MD5

    e98f7db67e567eee870d0bdbc078cf30

  • SHA1

    cdbe9abe7426a5f237e70eba3009bd415f363b9f

  • SHA256

    cd5cfb5118e9af25a488d5c360c67d934193fcbcd649bf2ff88afe5860da88b3

  • SHA512

    eba5f3b8d1c168e3fd762156e40ac658e39bb2e480c4f461811f2d510fddf04a28e3326d19f5dad15be580303cbc383d5babefc2fa2b7feacef7ac5b01b33a84

  • SSDEEP

    24576:NoWfjScOu165U4sgcb1VG+KP0Ce1Rl1U:NoWZOzb0lKP0Ce1Rlu

Score
10/10
formbookss63ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ss63

Decoy

heartgroupfurniture.com

petruskraftshop.net

bernesespirit.com

minulgul.com

canoncashier.com

britishsaschool.com

frau-kruppa.net

cj-zn.com

derdggyih5ctsc.kred

xvvbros.pics

unacucinadipasta.com

brandsalted.com

pledialinks.xyz

teslamoto.shop

doxycyclin.monster

nuflowalexandriava.com

eliteinfratech.com

laymember.net

bestprobiotics.online

diversifiedpower.international

Targets

    • Target

      SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe

    • Size

      823KB

    • MD5

      e98f7db67e567eee870d0bdbc078cf30

    • SHA1

      cdbe9abe7426a5f237e70eba3009bd415f363b9f

    • SHA256

      cd5cfb5118e9af25a488d5c360c67d934193fcbcd649bf2ff88afe5860da88b3

    • SHA512

      eba5f3b8d1c168e3fd762156e40ac658e39bb2e480c4f461811f2d510fddf04a28e3326d19f5dad15be580303cbc383d5babefc2fa2b7feacef7ac5b01b33a84

    • SSDEEP

      24576:NoWfjScOu165U4sgcb1VG+KP0Ce1Rl1U:NoWZOzb0lKP0Ce1Rlu

    Score
    10/10
    formbookss63ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks