Overview

overview

10

Static

static

3

SecuriteIn...79.exe

windows7-x64

10

SecuriteIn...79.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe
  • Size 559KB
  • Sample231127-defveadh82
  • SHA256 5d4ef95e2d68ad71b54c79a6a8fcfdee4d64ac4187e30a9b8523e0dc6cdedd10
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookvl53ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • vl53

Decoy

  • bushypussypi.com

  • alzentori.com

  • pearlmassagecentre.com

  • zag6.com

  • workadumail.com

  • ferreelectricosdaniel.com

  • takethislolypopo.com

  • maylanicornier.com

  • nptstudio.com

  • dunasgolf.com

  • guangshangjituan.com

  • cj6p.lat

  • camloi.xyz

  • goldcoastkayakfishing.com

  • hiasannatal.site

  • safesnipper.com

  • adamssecurities.com

  • productizewithmalu.com

  • oral-nursing.online

  • adultproducts.top

Targets

    • Target
      SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe
    • Size 559KB
    • SHA256 5d4ef95e2d68ad71b54c79a6a8fcfdee4d64ac4187e30a9b8523e0dc6cdedd10
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookvl53ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks