Overview

overview

10

Static

static

3

SecuriteIn...38.exe

windows7-x64

10

SecuriteIn...38.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.PWSX-gen.14038.17638.exe
  • Size 647KB
  • Sample231011-e6jaaaab9y
  • SHA256 b8e44f4a0d92297c5bb5b217c121f0d032850b38749044face2b0014e789adfb
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookk0p2ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • k0p2

Decoy

  • theluxurytraveljournal.com

  • skybet10.com

  • mountruqal.online

  • onlyones.xyz

  • kloea.top

  • studio7crochet.online

  • dhv9gmy.top

  • walkereld.com

  • script-shore.com

  • bwerger02.xyz

  • clempi.xyz

  • lishapanchal.com

  • imagemaza.com

  • ludu65.com

  • zenith-leadership.com

  • undertheradar.zone

  • 802cm.top

  • budeny.com

  • piabellacasino338.com

  • eclipse-demolition.com

Targets

    • Target
      SecuriteInfo.com.Win32.PWSX-gen.14038.17638.exe
    • Size 647KB
    • SHA256 b8e44f4a0d92297c5bb5b217c121f0d032850b38749044face2b0014e789adfb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookk0p2ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks