Overview

overview

10

Static

static

3

SecuriteIn...56.exe

windows7-x64

10

SecuriteIn...56.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.CrypterX-gen.16180.19856.exe
  • Size 607KB
  • Sample230717-2dm44afa68
  • SHA256 d0b0c22cd8d89cc33def6e5e61f4afd8d3f2aafdeba6833aa686489a104eefce
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookgd30ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • gd30

Decoy

  • b6oscovs.com

  • adventure-junket.com

  • ohlalaclothing.com

  • thecornerreinosa.com

  • vinctechnologies.com

  • klineperformanceproducts.com

  • remolquesjlf.com

  • yodions.com

  • zyggyy.com

  • jsdaat.com

  • ningbojunyangkeji.com

  • x-one-fashion.com

  • ypgewzamu.com

  • saleleasebackblueprint.com

  • 12zqud.com

  • joincrewpartners.com

  • ankaradyvarkagit.com

  • plentysloveg.com

  • aromatikaperu.com

  • v-erizon.com

Targets

    • Target
      SecuriteInfo.com.Win32.CrypterX-gen.16180.19856.exe
    • Size 607KB
    • SHA256 d0b0c22cd8d89cc33def6e5e61f4afd8d3f2aafdeba6833aa686489a104eefce
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookgd30ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks