Overview

overview

10

Static

static

SecuriteIn...28.exe

windows7-x64

10

SecuriteIn...28.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Trojan.Packed2.44597.4928.31978

  • Size

    1.1MB

  • Sample

    221123-g858yadf37

  • MD5

    002e87b0ea62442b8c89ccfba9137109

  • SHA1

    0b283d4f22bc526f3c2d98b3d64430bba393ebdd

  • SHA256

    722f3b52c9b45f5a0219423bf17052ea5cb2d4e9dc6a461af97ca55f13678ac4

  • SHA512

    9332f8212b18047743cdf8a5ea4e95463d7ad5302c91b05cf9d4b336b55e356912502dc5cda722697026d818675f8e400038fe22ea0ef6f20f7a1fe9fb69646b

  • SSDEEP

    24576:wUTGpqdOpYgvymjwNJgs6+RrGj1En1w5:wnpqdOeg6mOn5Gj1aw

Score
10/10
formbookxloaderfofgloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

fofg

Decoy

FHyydxpFBs0S8b4ZlP7ZEtd/

EVaCEKb/cVV9xQ==

U9I5lke0IuU7vj5EXus=

rXD3AKPV3qUblOUsV41KMfU=

PwBSy5z56XNzIvnS3ygsKv0=

CQe1BLbSnGXX

HuhKjxhLhxqBy2FFz8WoFA==

QJymezEoLOFZ1T5EXus=

V8r5PAdwuGK2AUARohas

b1XV06ANH9s5uj5EXus=

3EiEhwo7Euw2tl8=

c2PjK8Izkydy5N8x

CXCkYf0m/qPrv8QajKyT6Oo=

pHjy+Mk0CqvWBXdCz8WoFA==

QjSwr3/j5rAyvz5EXus=

+edxANg/sU+k8YFQz8WoFA==

tWiQq3rqyl6cTAG9pA==

GeAyMQxBUOlDwD5EXus=

nQ5eoT2mEKkhDN2DwBek

JP5dIbHlrXXR8umDwBek

Targets

    • Target

      SecuriteInfo.com.Trojan.Packed2.44597.4928.31978

    • Size

      1.1MB

    • MD5

      002e87b0ea62442b8c89ccfba9137109

    • SHA1

      0b283d4f22bc526f3c2d98b3d64430bba393ebdd

    • SHA256

      722f3b52c9b45f5a0219423bf17052ea5cb2d4e9dc6a461af97ca55f13678ac4

    • SHA512

      9332f8212b18047743cdf8a5ea4e95463d7ad5302c91b05cf9d4b336b55e356912502dc5cda722697026d818675f8e400038fe22ea0ef6f20f7a1fe9fb69646b

    • SSDEEP

      24576:wUTGpqdOpYgvymjwNJgs6+RrGj1En1w5:wnpqdOeg6mOn5Gj1aw

    Score
    10/10
    formbookxloaderfofgloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks