Overview

overview

10

Static

static

SecuriteIn...69.exe

windows7_x64

10

SecuriteIn...69.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.W32.AIDetectNet.01.15769.16566
  • Size 631KB
  • Sample220708-e64afsbfd6
  • SHA256 ea4ca77890daba701679e692e4ad121c665c5089082450e00eb921976dffbe04
  • MD5 SHA1 SHA512
Score
10/10
formbookhw05ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • hw05

Decoy

  • goride.xyz

  • driptailor.com

  • cpamediabusiness.com

  • blvckmd.com

  • winerpilot.xyz

  • gobet88.space

  • bagro.life

  • kwri.online

  • fcasaburiferdorador.com

  • hauntinghouse.media

  • parkcity.finance

  • citipayee.com

  • aboveallinspection.com

  • insightsoindia.com

  • 2022stanleycupchampions.com

  • opciondeportes.store

  • assistantform.com

  • seto-sunday.net

  • qttcon.com

  • hattori-home.com

Targets

    • Target
      SecuriteInfo.com.W32.AIDetectNet.01.15769.16566
    • Size 631KB
    • SHA256 ea4ca77890daba701679e692e4ad121c665c5089082450e00eb921976dffbe04
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookhw05ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks