Overview

overview

10

Static

static

1

SecuriteIn...48.exe

windows7-x64

10

SecuriteIn...48.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.InjectorX-gen.11327.14248.exe
  • Size 259KB
  • Sample221207-e38qrsgf8y
  • SHA256 f88caffeed956cd5b1671dde49bfc61dac4fd2007b46287debf7dab6c179bf46
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookpr28ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • pr28

Decoy

  • huaxinimg.com

  • baorungas.com

  • comercializadoramultimus.com

  • blr-batipro.com

  • wantagedfas.uk

  • 1thingplan.one

  • cweilin.com

  • lorienconsultingllc.com

  • jdzsjwx.com

  • casafacil.site

  • hkacgt.com

  • hasid.africa

  • 92dgr97k4hr9.com

  • cvbiop.xyz

  • 1wbskm.top

  • fantasticmobility.com

  • goodchoice2022.com

  • hafizpower.com

  • familiajoya.com

  • fundscrahelp.info

Targets

    • Target
      SecuriteInfo.com.Win32.InjectorX-gen.11327.14248.exe
    • Size 259KB
    • SHA256 f88caffeed956cd5b1671dde49bfc61dac4fd2007b46287debf7dab6c179bf46
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookpr28ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks