Overview

overview

10

Static

static

3

SecuriteIn...25.exe

windows7-x64

10

SecuriteIn...25.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe
  • Size 364KB
  • Sample231121-jbsyfsda59
  • SHA256 129156f77f3dca373d74c668a7e4250e0812fb36bdb926aeb2ef0dec4c122846
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooko11yratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • o11y

Decoy

  • bilenoer.online

  • 1gocasino.click

  • bm9qn.top

  • wzefoy.com

  • 5-minutemoney.com

  • tx5288.com

  • ssteaq.com

  • ztxsm2gxqvl.asia

  • familyfishing.world

  • moocytrading.com

  • dondebusques.com

  • dtservicesillinois.com

  • korpativnighs.com

  • resilientjoy.com

  • greensclps.com

  • actionkillsfear.com

  • siwu81.com

  • localorion.online

  • spoke99.com

  • taxinhanh24h.site

Targets

    • Target
      SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe
    • Size 364KB
    • SHA256 129156f77f3dca373d74c668a7e4250e0812fb36bdb926aeb2ef0dec4c122846
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooko11yratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks