Overview

overview

10

Static

static

SecuriteIn...80.exe

windows7-x64

10

SecuriteIn...80.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe
  • Size 952KB
  • Sample221108-lml1dsbhdn
  • SHA256 ed575e87b8ddb54cdd3f247dc89ac394081bbd503cbd6b29d1a4592d60aa07a6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookqmparatspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • qmpa

Decoy

  • IEiN8oqOnNUEkfZd

  • LWyAr1P5PHPV

  • tMGP9gYCIc9DKQ==

  • fWi2stCh2E3DBWuEK612

  • B3LCCi2JvPxfNA==

  • NjLnNjX+DDWt/VuEK612

  • AvK5/JdMDLztPRg=

  • U+zn2FswDLztPRg=

  • 3bRIXGwsIc9DKQ==

  • EXmAoj3/7Cyl+VuEK612

  • 1gkKPklP1odxx7c/Zm+L6HeV4g==

  • 1cMaHDg0ypV0vbT2Ibh+/5Cj5xmAVxA=

  • MSyBdIV+6nFRloTQAwmFklQ=

  • qilszGJvhMUsHgaUx/MNSKuo6A==

  • WYKLwmYEij4q2Hy6sOc=

  • sjII/IyFmORBFPJ2dVjpG0Q=

  • mTjzaRwZ9OsEkfZd

  • iL27vFhbX5ECbBIJxvJKbPHFf9M=

  • 5A5Xr0D5PHPV

  • IpxsaTO4a1/I

Targets

    • Target
      SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe
    • Size 952KB
    • SHA256 ed575e87b8ddb54cdd3f247dc89ac394081bbd503cbd6b29d1a4592d60aa07a6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookqmparatspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks