Overview

overview

10

Static

static

SecuriteIn...67.exe

windows7-x64

10

SecuriteIn...67.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.IL.Trojan.MSILMamut.8478.32531.29967.exe
  • Size 886KB
  • Sample230108-s2f61sdh86
  • SHA256 97b334f37fc97394c8883f87db4f95a5e5a2a3ca064d6a9720eaa429bb0f729c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookjn85ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • jn85

Decoy

  • 106c6423c3.com

  • vittoriospumpherston.co.uk

  • furniture-best.com

  • employersfindme.online

  • colegioagustinruiz.com

  • fuziservice.com

  • differentlokal.com

  • azzfasst.com

  • kerncereus.online

  • johnschottllc.com

  • disembark-burgeoned.click

  • cabliviwarranty.com

  • justzionism.com

  • diplomy-ua.top

  • cloudadonis.com

  • vaalepoxies.africa

  • ky2088.vip

  • gsportal.africa

  • alphastrength-us.com

  • homerams.com

Targets

    • Target
      SecuriteInfo.com.IL.Trojan.MSILMamut.8478.32531.29967.exe
    • Size 886KB
    • SHA256 97b334f37fc97394c8883f87db4f95a5e5a2a3ca064d6a9720eaa429bb0f729c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookjn85ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks