Overview

overview

10

Static

static

3

SecuriteIn...90.exe

windows7-x64

10

SecuriteIn...90.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.PWSX-gen.14716.17790.exe
  • Size 538KB
  • Sample231122-h4c72aah63
  • SHA256 baa2e4bc9527c3b121f69e7d581344f27b3b8cfbb867857e5d2c8e7b6e6d03af
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookvl53ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • vl53

Decoy

  • bushypussypi.com

  • alzentori.com

  • pearlmassagecentre.com

  • zag6.com

  • workadumail.com

  • ferreelectricosdaniel.com

  • takethislolypopo.com

  • maylanicornier.com

  • nptstudio.com

  • dunasgolf.com

  • guangshangjituan.com

  • cj6p.lat

  • camloi.xyz

  • goldcoastkayakfishing.com

  • hiasannatal.site

  • safesnipper.com

  • adamssecurities.com

  • productizewithmalu.com

  • oral-nursing.online

  • adultproducts.top

Targets

    • Target
      SecuriteInfo.com.Win32.PWSX-gen.14716.17790.exe
    • Size 538KB
    • SHA256 baa2e4bc9527c3b121f69e7d581344f27b3b8cfbb867857e5d2c8e7b6e6d03af
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookvl53ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks