Overview

overview

10

Static

static

SecuriteIn...22.exe

windows7-x64

10

SecuriteIn...22.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.PWSX-gen.16326.5122.exe
  • Size 519KB
  • Sample221114-gd1d7sfb35
  • SHA256 5227918355b47bf8f0cf6eabb0628ff59339d6fd6a3a56ceca4dcefd06dd8d00
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookcfvcratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • cfvc

Decoy

  • qFcyI8OAPHKap6ubfQ==

  • NuOCNnr/zOqy1xM5AN4=

  • CnHfypZMLKQKgKaaVw4J1g==

  • 9WpDFnsiwEyoFko7+GYiyo55

  • zUKhZPi3f21+ux+L

  • vqqeiTTPlz+cnQaD

  • GLGZh9zop+UvsCtBEm9x

  • eCUGyUEAe9hmj8KgaA==

  • EvXUn0s63zJyoxQfCGQmMZRu

  • kVy6iO/FuRGD/A==

  • +tg0M82KQk7fX4XXoYIluHMEFhbrzMk=

  • hP/nqutI9DR+0mBnYA==

  • cwrq1kLJd9QzqtQq9QCc7hHV9FjjKSvU

  • eE6vlcLHxAHZ7g==

  • vpKQL84+30y4SZpU/Ox5

  • vbfnlWZmAj1aVbCdbA==

  • UNQwEfT8tzbiL3J2Wrjm3g==

  • 02LLqYRY9SeDIHwK5pFjYrg=

  • PhkLzj8IuT6R7v3lxlBYwqO69HReqnrF

  • mkYwC5lsF6cDS6RU/Ox5

Targets

    • Target
      SecuriteInfo.com.Win32.PWSX-gen.16326.5122.exe
    • Size 519KB
    • SHA256 5227918355b47bf8f0cf6eabb0628ff59339d6fd6a3a56ceca4dcefd06dd8d00
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookcfvcratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks