Overview

overview

10

Static

static

SecuriteIn...31.exe

windows7-x64

10

SecuriteIn...31.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win64.PWSX-gen.11274.31831.exe
  • Size 465KB
  • Sample221115-lm7xvscc6t
  • SHA256 4fcd149028440c9596e308a70da693c31b1c438e08d12917b17b871dcff52e20
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbook8bgmratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • 8bgm

Decoy

  • 23rm6QBJPPmRk5xp

  • JcoeQ/m8csTLTfk=

  • p6Zeuwa1+aIaQuY=

  • y8b44V5apH7sIScGv+9zR4NjsqAk

  • GysliaH2WSMJJTEZ/dGge/WaMUUI1Bt7MA==

  • oWEEVX2/+9as7EPpt+mqSnc=

  • VQFaa2jjdzsebwFJxxsNp55V7n8=

  • 6//EFXIFJfeRk5xp

  • 1O/ayFvk+txf1ZlLyLI=

  • cj6yQ7Y2T77GHSviui3wkL40

  • ZTOT0s5V+t8hQOp+

  • dUUHW3vGw+fqWw==

  • ChkGWUFKeVlX0lxqn1pUCQ==

  • Ngv0b9BNnYOB64vydmcs8AYI4Hw=

  • rZFxXwi/2EpCeXzu/OWVO6Y+

  • Qk4teWRwtIeQ5++PdOtoK38=

  • BMFnOslQUAd0ACSxLAPGbrljsqAk

  • cIkeMTRDhEklslBon1pUCQ==

  • yWUj8VjX9Gub9ZzKSA==

  • OzfuRpkeQB2nMT+49RjVUao+

Targets

    • Target
      SecuriteInfo.com.Win64.PWSX-gen.11274.31831.exe
    • Size 465KB
    • SHA256 4fcd149028440c9596e308a70da693c31b1c438e08d12917b17b871dcff52e20
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbook8bgmratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks