Overview

overview

10

Static

static

SecuriteIn...34.exe

windows7-x64

10

SecuriteIn...34.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.PWSX-gen.32119.32634.exe
  • Size 697KB
  • Sample221124-d3l2bshf3x
  • SHA256 f8cd003e1c03f9239f2c22aba7d67b7597fb65749cd2513307082250023fea12
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookc0e5ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • c0e5

Decoy

  • educao.pet

  • e-race.store

  • clitzhyper.com

  • webcheetahtech.online

  • akkarr.online

  • odevillage.fit

  • yaignav.site

  • 191u.us

  • misionartv.store

  • leadingpastor.com

  • claudio-vega.store

  • 9mck753.com

  • system-reminder.live

  • landsharesfg.net

  • lmcsf.top

  • mkstoreacesse.com

  • 2023.domains

  • yb8.mobi

  • 2q02f4fyxg7ybb18.digital

  • logtray.shop

Targets

    • Target
      SecuriteInfo.com.Win32.PWSX-gen.32119.32634.exe
    • Size 697KB
    • SHA256 f8cd003e1c03f9239f2c22aba7d67b7597fb65749cd2513307082250023fea12
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookc0e5ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks