Overview

overview

10

Static

static

SecuriteIn...80.exe

windows7-x64

6

SecuriteIn...80.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.IL.Trojan.MSILZilla.23856.25548.25480.exe
  • Size 2.3MB
  • Sample221108-yps8psefg8
  • SHA256 b30ff09cd639b2029019e4328bad876c683c25ae2a4d4dd0abea67ea8d759e1f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookfbcepersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • fbce

Decoy

  • Z4SlvN7wcIB/2gY=

  • FFxoAMtxrL9l7g==

  • mKvH23KL1Kkslrophi2XdTixtw==

  • ts/+Gjx4QSxh2v/2bgWSdTixtw==

  • 1+wJH6lV4UJyjr7vbBg=

  • yR65207vjV/6Q6UHbA==

  • Y2Wer9IX36etHIQvahE=

  • m6bDwG4ZqmXdJmxfulNdSORn

  • 9JCvDS+6rL9l7g==

  • h8BVhgCWF42kNWJ0kEEG

  • E4cgTU/1Dd/vUGxctFFdSORn

  • Sas/mUy2gu3J6w==

  • gXrJPNkWYT9+yAM0LxuSOA==

  • uwi39xAk3ausGIQvahE=

  • L9UlTdkVJI0sKFML

  • FRFTqk6M/uOMHTt+s4xkLw==

  • frH5Cqk6Ze7X7GBvzGRsUIa7/nAbM3l4+Q==

  • Woez0ZwtpgHbKUQrZUwMgDI=

  • ODtHQ3o5PY0sKFML

  • lrHa5P2LmHI5d5QRLxuSOA==

Targets

    • Target
      SecuriteInfo.com.IL.Trojan.MSILZilla.23856.25548.25480.exe
    • Size 2.3MB
    • SHA256 b30ff09cd639b2029019e4328bad876c683c25ae2a4d4dd0abea67ea8d759e1f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    persistenceformbookfbceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks