Overview

overview

10

Static

static

1

SecuriteIn...19.exe

windows7-x64

10

SecuriteIn...19.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.Garf.Gen.6.7190.31519.exe
  • Size 272KB
  • Sample221213-e4tm8sde74
  • SHA256 afb4878ecf77a506fee3c5d2b817d8197edd0df8baddb32563027023e6bf35cc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookscsepersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • scse

Decoy

  • SKpYFyVNT2zunKf0uuM=

  • FlEHUseI7I5XbrO8fR/XBcS9ZA==

  • FPuxoUOxkLiATugw

  • VKdxsDSk0jdT5Kw=

  • FpqHf9iI/1tl97E=

  • YGI6sIl3UIxfZvlD+JiUuuLR

  • oBAEO0suBEAD5aK00A==

  • RKJqTzg4gQ/Q6DYSuTjDGkwuyl0ik5Kb8w==

  • VFg9s3W0/Ype8A3cZb+D7g==

  • hwD+VNd6014nrsaTWm4FBcS9ZA==

  • zkAdUq1soKYUfZaTqLmL

  • XVQ9WbRivUIQ477a/hKv+g==

  • QireF2geizAwmp674AGc5g==

  • PSTUQxs6j8OATugw

  • LHJhyy2VbX8NEqf0uuM=

  • MiY1vg6T3HqATugw

  • wqkUjaVXnGgBqA==

  • jUr/eUtSIT01Wegt

  • PjQidcqKzAbSZICUZb+D7g==

  • OkAmcv12sUEAIHwFHakzdIo2FPHw

Targets

    • Target
      SecuriteInfo.com.Trojan.Garf.Gen.6.7190.31519.exe
    • Size 272KB
    • SHA256 afb4878ecf77a506fee3c5d2b817d8197edd0df8baddb32563027023e6bf35cc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookscsepersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks