Summary: 2025/04/28 23:49
First reported date: 2017/09/20
Inquiry period : 2025/03/29 23:49 ~ 2025/04/28 23:49 (1 months), 10 search results
전 기간대비 -10% 낮은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 Campaign Malware Phishing United States 입니다.
악성코드 유형 Lobshot BlackSuit Ransomware Stealc Raccoon DYEPACK Nanocore Emotet RedLine RecordBreaker GameoverP2P Vidar 도 새롭게 확인됩니다.
공격기술 Stealer Social Engineering 도 새롭게 확인됩니다.
기관 및 기업 Microsoft Recorded Future Germany CrowdStrike Kaspersky China Russia Fortinet 도 새롭게 확인됩니다.
기타 Infostealer Malware download Cryptocurrency Victim greyareaclothingstore 등 신규 키워드도 확인됩니다.
FormBook is a well-known commercial malware that steals information from victims’ machines using keyloggers and form grabbers.
* 최근 뉴스기사 Top3:
ㆍ 2025/04/23 Private: Stealing the Future: Infostealers Power Cybercrime in 2025
ㆍ 2025/04/08 How MSSP Expertware Uses ANY.RUN’s Interactive Sandbox for Faster Threat Analysis
참고로 동일한 그룹의 악성코드 타입은 FormBook QakBot RedLine 등 101개 종이 확인됩니다.
Trend graph by period
Related keyword cloud
Top 100| # | Trend | Count | Comparison |
|---|---|---|---|
| 1 | FormBook | 10 | ▼ -1 (-10%) |
| 2 | Stealer | 5 | ▲ new |
| 3 | Campaign | 5 | ▲ 3 (60%) |
| 4 | Malware | 5 | ▲ 2 (40%) |
| 5 | IoC | 4 | ▼ -1 (-25%) |
| 6 | Phishing | 4 | ▲ 3 (75%) |
| 7 | Report | 3 | - 0 (0%) |
| 8 | Remcos | 2 | ▼ -1 (-50%) |
| 9 | Lumma | 2 | - 0 (0%) |
| 10 | AgentTesla | 2 | ▼ -1 (-50%) |
| 11 | Advertising | 2 | ▼ -1 (-50%) |
| 12 | Microsoft | 2 | ▲ new |
| 13 | United States | 2 | ▲ 1 (50%) |
| 14 | Infostealer | 2 | ▲ new |
| 15 | Malware download | 1 | ▲ new |
| 16 | Recorded Future | 1 | ▲ new |
| 17 | Cryptocurrency | 1 | ▲ new |
| 18 | Victim | 1 | ▲ new |
| 19 | Lobshot | 1 | ▲ new |
| 20 | Germany | 1 | ▲ new |
| 21 | BlackSuit | 1 | ▲ new |
| 22 | Ransomware | 1 | ▲ new |
| 23 | greyareaclothingstore | 1 | ▲ new |
| 24 | DarkWeb | 1 | ▲ new |
| 25 | MFA | 1 | ▲ new |
| 26 | Stealc | 1 | ▲ new |
| 27 | EDR | 1 | ▲ new |
| 28 | CrowdStrike | 1 | ▲ new |
| 29 | Ch | 1 | ▲ new |
| 30 | Social Engineering | 1 | ▲ new |
| 31 | FortiGuard | 1 | ▲ new |
| 32 | Labs | 1 | ▲ new |
| 33 | antesyapionline | 1 | ▲ new |
| 34 | igbeeonline | 1 | ▲ new |
| 35 | fizzjetlive | 1 | ▲ new |
| 36 | landsflllc | 1 | ▲ new |
| 37 | Tofsee | 1 | ▼ -1 (-100%) |
| 38 | XWorm | 1 | ▼ -2 (-200%) |
| 39 | AsyncRAT | 1 | ▼ -2 (-200%) |
| 40 | neconyd | 1 | ▲ new |
| 41 | snake | 1 | ▼ -1 (-100%) |
| 42 | Amadey | 1 | - 0 (0%) |
| 43 | Top | 1 | ▼ -1 (-100%) |
| 44 | last | 1 | ▼ -1 (-100%) |
| 45 | hellosweetienet | 1 | ▲ new |
| 46 | IBM | 1 | ▲ new |
| 47 | Raccoon | 1 | ▲ new |
| 48 | DYEPACK | 1 | ▲ new |
| 49 | Nanocore | 1 | ▲ new |
| 50 | Cobalt Strike | 1 | ▲ new |
| 51 | Emotet | 1 | ▲ new |
| 52 | Android | 1 | ▲ new |
| 53 | RedLine | 1 | ▲ new |
| 54 | Kaspersky | 1 | ▲ new |
| 55 | China | 1 | ▲ new |
| 56 | Russia | 1 | ▲ new |
| 57 | c&c | 1 | - 0 (0%) |
| 58 | powershell | 1 | ▲ new |
| 59 | RecordBreaker | 1 | ▲ new |
| 60 | httpstco | 1 | ▲ new |
| 61 | GameoverP2P | 1 | ▲ new |
| 62 | Xloader | 1 | ▼ -2 (-200%) |
| 63 | aramco | 1 | ▲ new |
| 64 | QRadar Security Suite | 1 | ▲ new |
| 65 | Linux | 1 | - 0 (0%) |
| 66 | Windows | 1 | - 0 (0%) |
| 67 | Education | 1 | ▲ new |
| 68 | MalSpam | 1 | ▼ -2 (-200%) |
| 69 | Fortinet | 1 | ▲ new |
| 70 | Threat | 1 | - 0 (0%) |
| 71 | Research | 1 | ▲ new |
| 72 | Blog | 1 | ▲ new |
| 73 | vaishnavixyz | 1 | ▲ new |
| 74 | ThreatProtection | 1 | ▲ new |
| 75 | recent | 1 | ▲ new |
| 76 | Distribution | 1 | ▲ new |
| 77 | NortonLifeLock | 1 | ▲ new |
| 78 | Vidar | 1 | ▲ new |
| 79 | NetWireRC | 1 | ▼ -2 (-200%) |
Special keyword group
Top 5
Malware Type
This is the type of malware that is becoming an issue.
| Keyword | Average | Label |
|---|---|---|
| FormBook |
|
10 (30.3%) |
| Remcos |
|
2 (6.1%) |
| Lumma |
|
2 (6.1%) |
| AgentTesla |
|
2 (6.1%) |
| Lobshot |
|
1 (3%) |
Attacker & Actors
The status of the attacker or attack group being issued.
| Keyword | Average | Label |
|---|
Technique
This is an attack technique that is becoming an issue.
| Keyword | Average | Label |
|---|---|---|
| Stealer |
|
5 (31.3%) |
| Campaign |
|
5 (31.3%) |
| Phishing |
|
4 (25%) |
| Social Engineering |
|
1 (6.3%) |
| MalSpam |
|
1 (6.3%) |
Country & Company
This is a country or company that is an issue.
| Keyword | Average | Label |
|---|---|---|
| Microsoft |
|
2 (18.2%) |
| United States |
|
2 (18.2%) |
| Recorded Future |
|
1 (9.1%) |
| Germany |
|
1 (9.1%) |
| CrowdStrike |
|
1 (9.1%) |
Malware Family
Top 5
A malware family is a group of applications with similar attack techniques.
In this trend, it is classified into Ransomware, Stealer, RAT or Backdoor, Loader, Botnet, Cryptocurrency Miner.
Threat info
Last 5SNS
(Total : 8)FormBook Stealer IoC Campaign Malware Phishing Lumma Report XWorm AsyncRAT Remcos Amadey AgentTesla NetWireRC Distribution China MalSpam Russia Kaspersky Fortinet Advertising
News
(Total : 2)FormBook Malware Microsoft Campaign Report Phishing United States DarkWeb Lobshot IBM Social Engineering AgentTesla Cryptocurrency Victim Attacker Recorded Future Germany MFA BlackSuit Ransomware Vidar CrowdStrike EDR Stealc Lumma QRadar Security Suite Linux Advertising IoC Emotet Remcos Raccoon Nanocore Cobalt Strike Android c&c Education powershell RecordBreaker GameoverP2P Xloader DYEPACK Stealer RedLine Windows
| No | Title | Date |
|---|---|---|
| 1 | Private: Stealing the Future: Infostealers Power Cybercrime in 2025 - Malware.News | 2025.04.23 |
| 2 | How MSSP Expertware Uses ANY.RUN’s Interactive Sandbox for Faster Threat Analysis - Malware.News | 2025.04.08 |
Additional information
| No | Title | Date |
|---|---|---|
| 1 | Employee monitoring app exposes users, leaks 21+ million screenshots - Malware.News | 2025.04.28 |
| 2 | Introducing XSIAM 3.0 - Malware.News | 2025.04.28 |
| 3 | Deploy Bravely with Prisma AIRS - Malware.News | 2025.04.28 |
| 4 | 2025 Cyber Resilience Research Discovers Speed of AI Advancing Emerging Attack Types - Malware.News | 2025.04.28 |
| 5 | Intel CEO Targets Change in Corporate Culture to Shape Up - Bloomberg Technology | 2025.04.28 |
| View only the last 5 | ||
| No | Title | Date |
|---|---|---|
| 1 | Private: Stealing the Future: Infostealers Power Cybercrime in 2025 - Malware.News | 2025.04.23 |
| 2 | Private: Stealing the Future: Infostealers Power Cybercrime in 2025 - Malware.News | 2025.04.23 |
| 3 | Private: Stealing the Future: Infostealers Power Cybercrime in 2025 - Malware.News | 2025.04.23 |
| 4 | Private: Stealing the Future: Infostealers Power Cybercrime in 2025 - Malware.News | 2025.04.23 |
| 5 | How MSSP Expertware Uses ANY.RUN’s Interactive Sandbox for Faster Threat Analysis - Malware.News | 2025.04.08 |
| View only the last 5 | ||
| No | Request | Hash(md5) | Report No | Date |
|---|---|---|---|---|
| 1 |  UQdB.exeFormbook Generic Malware .NET framework(MSIL) Malicious Library UPX Antivirus PWS AntiDebug AntiVM PE File .NET EXE PE32 DLL | 143aa2a76396aab15a8bf762dfa7f377 | 59879 | 2025.04.23 |
| 2 |  csrss.exeFormbook Process Kill Generic Malware Suspicious_Script_Bin Malicious Library FindFirstVolume CryptGenKey UPX PE File PE32 Device_File_Check OS Processor Ch | 67e4a0dc097ec49476cd4e56805e5e56 | 58946 | 2025.04.11 |
| 3 |  cosses.exeFormbook Process Kill Generic Malware Malicious Library FindFirstVolume CryptGenKey | c338c9cdccb21a6f023987865b4a6269 | 58240 | 2025.03.21 |
| 4 |  vfc.exeFormbook Process Kill Generic Malware Malicious Library FindFirstVolume CryptGenKey | 907d825de589180257b3cdd1515c7002 | 58242 | 2025.03.21 |
| 5 |  vsse.exeFormbook Process Kill Generic Malware Malicious Library FindFirstVolume CryptGenKey UPX PE File Device_File_Check PE32 OS Process | cd00eab486d24844b6ae7933c4514271 | 58243 | 2025.03.21 |
| View only the last 5 | ||||
| Level | Description |
|---|---|
| danger | Executed a process and injected code into it |
| warning | File has been identified by 24 AntiVirus engines on VirusTotal as malicious |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Attempts to identify installed AV products by installation directory |
| watch | Code injection by writing an executable or DLL to the memory of another process |
| watch | Manipulates memory of a non-child process indicative of process injection |
| watch | Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe |
| watch | One or more non-whitelisted processes were created |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | The processes powershell.exe |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| watch | Wscript.exe initiated network communications indicative of a script based payload download |
| notice | A process attempted to delay the analysis task. |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a shortcut to an executable file |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Drops an executable to the user AppData folder |
| notice | One or more potentially interesting buffers were extracted |
| notice | Performs some HTTP requests |
| notice | Resolves a suspicious Top Level Domain (TLD) |
| notice | Sends data using the HTTP POST Method |
| notice | Steals private information from local Internet browsers |
| notice | Terminates another process |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | Uses Windows APIs to generate a cryptographic key |
| Network | ET DNS Query to a *.top domain - Likely Hostile |
| Network | ET INFO HTTP Request to a *.top domain |
| No | Category | URL | CC | ASN Co | Date |
|---|---|---|---|---|---|
| 1 | c2 | http://www.436bet.lol/lcva/ | US  | CLOUDFLARENET | 2025.04.23 |
| 2 | c2 | http://www.igbee.online/tyrp/ | VG  | CONFLUENCE-NETWORK-INC | 2025.04.23 |
| 3 | c2 | http://www.meshki-co-uk.shop/b8n0/ | US | CLOUDFLARENET | 2025.04.11 |
| 4 | c2 | http://www.nesuns.asia/ | 2025.03.26 | ||
| 5 | c2 | http://www.aifriendship.store/ | 2025.03.26 | ||
| View only the last 5 | |||||
| No | URL | CC | ASN Co | Reporter | Date |
|---|---|---|---|---|---|
| 1 | http://185.215.113.19//inc/freedom.exe Formbook | anonymous | 2025.04.26 | ||
| 2 | http://185.215.113.19//inc/explorer.exe Formbook | anonymous | 2025.04.26 | ||
| 3 | http://185.215.113.117//inc/freedom.exe Formbook | abus3reports | 2025.04.26 | ||
| 4 | http://185.215.113.117//inc/explorer.exe Formbook | abus3reports | 2025.04.26 | ||
| 5 | https://paste.ee/r/BY9muntt/0 ascii Encoded Formbook | abuse_ch | 2025.04.25 | ||
| View only the last 5 | |||||