Overview

overview

10

Static

static

1

SecuriteIn...08.exe

windows7-x64

10

SecuriteIn...08.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.TrojanX-gen.15926.26008.exe
  • Size 779KB
  • Sample240227-d2gefsfb82
  • SHA256 2aae1c0d24cf1e75f9e392bc8df159de3cc10482ec6a692e45bfab89deade435
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookcz30ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • cz30

Decoy

  • valeriepuma.com

  • rentyourbag.com

  • unglesbyessure.com

  • ahzmjy.site

  • taazdelights.online

  • conexoesnews.com

  • istprimeway.com

  • elwf4tlu.shop

  • 661.support

  • fournaisehk.com

  • glechiu.xyz

  • 2r2pv2.shop

  • 902523.rip

  • bruggicapy.com

  • westmobileautodeatailers.online

  • muaad.co

  • gridxsens.com

  • victoronedesigns.com

  • tecexpressbr.com

  • crea4net.com

Targets

    • Target
      SecuriteInfo.com.Win32.TrojanX-gen.15926.26008.exe
    • Size 779KB
    • SHA256 2aae1c0d24cf1e75f9e392bc8df159de3cc10482ec6a692e45bfab89deade435
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookcz30ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks