Overview

overview

10

Static

static

SecuriteIn...59.exe

windows7-x64

10

SecuriteIn...59.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.PWSX-gen.24087.4059.exe
  • Size 588KB
  • Sample221027-qkhbmsccfk
  • SHA256 09cda694bcb240c7b0742de73888b7ab55db4f29ee1c6c471f4b8982dc150f5d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookng04ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ng04

Decoy

  • tevimaq.com

  • easterspecialtystore.com

  • smartlever.tech

  • 10312.uk

  • tanjawiharbi.co.uk

  • 471338.com

  • horusventure.com

  • empress-care.com

  • sinrian.com

  • 465951.com

  • aemsti.com

  • nxcourier.com

  • stargatefarms.com

  • lalyquainvestment.com

  • dailysportsadvice.com

  • justlistmoore.com

  • stoneonroll.online

  • tatianakolomiets.com

  • barcodebbm.com

  • protectorship.world

Targets

    • Target
      SecuriteInfo.com.Win32.PWSX-gen.24087.4059.exe
    • Size 588KB
    • SHA256 09cda694bcb240c7b0742de73888b7ab55db4f29ee1c6c471f4b8982dc150f5d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookng04ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks