Overview

overview

10

Static

static

3

SecuriteIn...86.exe

windows7-x64

10

SecuriteIn...86.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.PWSX-gen.29111.14586.exe
  • Size 606KB
  • Sample231213-pq62hsebb2
  • SHA256 9d833b4a66beca22dcee2a030ffa0ff1a9c72eba3f9ee50eb412f56806915f87
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookuh23ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • uh23

Decoy

  • hanaleikeyword.top

  • fai.ovh

  • jan8.site

  • golcondatowing.top

  • clearchoiceafh.net

  • qinglvzhuang8.com

  • luxurywatches.cat

  • katoonishop.com

  • kw2jm9er.shop

  • prodctionlaser.com

  • teachertransitionjobboard.com

  • qzlr6.site

  • kabir.tech

  • hnxuefengyuan.com

  • abc386.site

  • ra-myportfolio.com

  • bowanghg.com

  • disoklahoma.com

  • jordenshoots.com

  • imobje.space

Targets

    • Target
      SecuriteInfo.com.Win32.PWSX-gen.29111.14586.exe
    • Size 606KB
    • SHA256 9d833b4a66beca22dcee2a030ffa0ff1a9c72eba3f9ee50eb412f56806915f87
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookuh23ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks