Overview

overview

10

Static

static

SecuriteIn...97.exe

windows7-x64

1

SecuriteIn...97.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Downloader.MSIL.gen.rexp.15382.17197.exe
  • Size 15KB
  • Sample221122-e6jaaadf4y
  • SHA256 5fa79245acfe001f7b4269dadbe7b8ca5c4e3dbe5445b56c3f53c29c28bcb06b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookfs44ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • fs44

Decoy

  • whneat.com

  • jljcw.net

  • pocodelivery.com

  • outofplacezine.com

  • yavuzcansigorta.com

  • xinhewood-cn.com

  • cartogogh.com

  • 5avis.com

  • joyceyong.art

  • digitalsurf.community

  • blackcreekbarns.com

  • magazinedistribuidor.com

  • sportsgross.com

  • drevom.online

  • mayibeofservice.com

  • gareloi-digit.com

  • permitha.net

  • renaissanceestetica.com

  • facts-r-friends.com

  • dach-loc.com

Targets

    • Target
      SecuriteInfo.com.Downloader.MSIL.gen.rexp.15382.17197.exe
    • Size 15KB
    • SHA256 5fa79245acfe001f7b4269dadbe7b8ca5c4e3dbe5445b56c3f53c29c28bcb06b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookfs44ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks