Overview

overview

10

Static

static

SecuriteIn...73.exe

windows7-x64

10

SecuriteIn...73.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe
  • Size 964KB
  • Sample220901-d2gp8affar
  • SHA256 bc50bd102cef75bd5e2e54618302f10459cd18f90fbbba15ffb4d7503e7e895a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookko29ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ko29

Decoy

  • citusdig.site

  • ecomrise.store

  • aringtonortho.com

  • plan-indonesia.com

  • retreat-to-the-alps.com

  • themerchperch.biz

  • freshfashiondesign.com

  • zachmizrachi.com

  • machomancoin.site

  • racunhariini.com

  • 13378888.com

  • landofnd.com

  • techactive.digital

  • yourdebttips.com

  • www147171.com

  • xraino.top

  • willshouseofhorrors.com

  • redfiree.com

  • cyanband.com

  • srbs35.com

Targets

    • Target
      SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe
    • Size 964KB
    • SHA256 bc50bd102cef75bd5e2e54618302f10459cd18f90fbbba15ffb4d7503e7e895a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookko29ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks