Overview

overview

10

Static

static

1

SecuriteIn...52.exe

windows7-x64

10

SecuriteIn...52.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.PackedNET.2698.18590.6852.exe
  • Size 648KB
  • Sample240222-pxbtyshf64
  • SHA256 173e2bfd47ffa24de5fbfe5e293d5d0e76d7be2f69709f2098422d24d2421a77
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookcz30ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • cz30

Decoy

  • valeriepuma.com

  • rentyourbag.com

  • unglesbyessure.com

  • ahzmjy.site

  • taazdelights.online

  • conexoesnews.com

  • istprimeway.com

  • elwf4tlu.shop

  • 661.support

  • fournaisehk.com

  • glechiu.xyz

  • 2r2pv2.shop

  • 902523.rip

  • bruggicapy.com

  • westmobileautodeatailers.online

  • muaad.co

  • gridxsens.com

  • victoronedesigns.com

  • tecexpressbr.com

  • crea4net.com

Targets

    • Target
      SecuriteInfo.com.Trojan.PackedNET.2698.18590.6852.exe
    • Size 648KB
    • SHA256 173e2bfd47ffa24de5fbfe5e293d5d0e76d7be2f69709f2098422d24d2421a77
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookcz30ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks