Overview

overview

10

Static

static

3

SecuriteIn...78.exe

windows7-x64

10

SecuriteIn...78.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe
  • Size 364KB
  • Sample231115-h4x77seb53
  • SHA256 6282a84266a87aa1e62b1304913bfdc8ce4c122f59f5731503f78655beaaa27e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooko11yratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • o11y

Decoy

  • bilenoer.online

  • 1gocasino.click

  • bm9qn.top

  • wzefoy.com

  • 5-minutemoney.com

  • tx5288.com

  • ssteaq.com

  • ztxsm2gxqvl.asia

  • familyfishing.world

  • moocytrading.com

  • dondebusques.com

  • dtservicesillinois.com

  • korpativnighs.com

  • resilientjoy.com

  • greensclps.com

  • actionkillsfear.com

  • siwu81.com

  • localorion.online

  • spoke99.com

  • taxinhanh24h.site

Targets

    • Target
      SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe
    • Size 364KB
    • SHA256 6282a84266a87aa1e62b1304913bfdc8ce4c122f59f5731503f78655beaaa27e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooko11yratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks