Overview

overview

10

Static

static

3

SecuriteIn...03.exe

windows7-x64

1

SecuriteIn...03.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.PWSX-gen.25625.17803.exe
  • Size 326KB
  • Sample230711-hcbvwsff8y
  • SHA256 6e5b648d1e574dfbbd6337c6d11b851b2b12efec1f0ae59b1327e0dce1dfe7e6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooka0a2ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • a0a2

Decoy

  • littleconcernsociety.com

  • baigaoedu.com

  • jatpoloclub.com

  • luiwox.xyz

  • bearardath.com

  • infoversilia.com

  • ot-to-j.com

  • sable40k.com

  • whatravthinks.com

  • angelnajeraperez.com

  • juegosfriv2019com.com

  • i205towing.com

  • shmyhzd.com

  • dayschevorlet.com

  • ingnance.com

  • melaniemetheny.com

  • bigmatcarex.com

  • mbdgiftgallery.com

  • livesolerev.com

  • swimsuitlageprijs.com

Targets

    • Target
      SecuriteInfo.com.Win32.PWSX-gen.25625.17803.exe
    • Size 326KB
    • SHA256 6e5b648d1e574dfbbd6337c6d11b851b2b12efec1f0ae59b1327e0dce1dfe7e6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooka0a2ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks