Overview

overview

10

Static

static

SecuriteIn...24.exe

windows7-x64

10

SecuriteIn...24.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.MSIL.ClipBanker.11429.29024.exe
  • Size 698KB
  • Sample221117-vdyr9sfa23
  • SHA256 ab885c190a5cf8f650a0c8ff3b6e0bd2ed857e4126cfde672fa5a70db5616751
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookg25eratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • g25e

Decoy

  • 2491254125.xyz

  • hookd.gay

  • uxmelange.com

  • startupvision3.com

  • evanwoosley-reed.com

  • uspalupdser.info

  • lx0599.com

  • grupoiaez.com

  • londonpapershop.com

  • cremas.store

  • risespec.com

  • olivierverdoyant.com

  • creatednow.com

  • epicureanhometreats.com

  • iqijp.com

  • vcraftboutique.com

  • furnaristudios.com

  • dealsgolf.com

  • djwoojs.com

  • boatslave.com

Targets

    • Target
      SecuriteInfo.com.Trojan.MSIL.ClipBanker.11429.29024.exe
    • Size 698KB
    • SHA256 ab885c190a5cf8f650a0c8ff3b6e0bd2ed857e4126cfde672fa5a70db5616751
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookg25eratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks