Overview

overview

10

Static

static

1

SecuriteIn...50.exe

windows7-x64

10

SecuriteIn...50.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.RATX-gen.3194.15750.exe
  • Size 1.1MB
  • Sample240315-rt6ahach76
  • SHA256 b3dd3ec805692dca3ce544068053b8d4e85521265dd4a1392ecf0d47b2814c66
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookns03ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ns03

Decoy

  • dipity.tech

  • agathis.fun

  • ekaterinai.store

  • elizabethsbookshelf.com

  • smilesustainably.com

  • tapeworm.xyz

  • beatricesswarthout.xyz

  • nsrpackersandpackers.in

  • yedxec.xyz

  • gildedbeautyaesthitics.com

  • hanibalbechar.com

  • fichaphuman.net

  • adilosk.shop

  • geezaran.com

  • ventasemail.com

  • phonecasesdirect.store

  • rctjuc.shop

  • sukimossmanagement.com

  • caller-id.today

  • kft07.vip

Targets

    • Target
      SecuriteInfo.com.Win32.RATX-gen.3194.15750.exe
    • Size 1.1MB
    • SHA256 b3dd3ec805692dca3ce544068053b8d4e85521265dd4a1392ecf0d47b2814c66
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookns03ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks