General
-
Target
54d9e41dc860087321eb979b18858f109d7d45c73da540a19d343fc17cce8ccb
-
Size
494KB
-
Sample
220521-atjm3aagd7
-
MD5
7db666b1c7e2b5814d4ddb8def92a8d5
-
SHA1
a0a9c0522febf8ccb1354a37f0a42d7b4ce6fd74
-
SHA256
54d9e41dc860087321eb979b18858f109d7d45c73da540a19d343fc17cce8ccb
-
SHA512
c46caf30acddc2149df2a48bd79ce3f86976cd2c25d7c8192a86fe27208f7610cbc0d15330aff1858573a60990623b4f15e4ae1806986e221dcda3a38bc8e33e
Static task
static1
Behavioral task
behavioral1
Sample
yeni sipari?.exe
Resource
win7-20220414-en
Malware Config
Extracted
formbook
4.1
kvsz
okashyns.com
sbsgamedaejeon-two.com
drb77.com
top5dating.com
websprings.online
voizers.com
zenith.site
lahistoriade.com
qv85.com
armandonieto.com
priestvedic.com
jessandjeff.net
magic-desktop.com
jitaji.com
ldmeili.com
yuwanqingmy.com
buzhouorg.com
chaiseloungereviews.com
m2g8way.com
freespin-support.com
bocapvang.net
315px.com
eugeniobarros.tech
sif.email
xn--oorv2aj6bj7cds0d6p4b.com
polychips.com
grouptulip.win
landbank.site
bet365c.win
inbonz.com
outofthepark.today
jeaniney.com
weeip.com
dmoneylife.com
rticlubs.com
reisedating.com
marijuanadogbone.com
funippon.com
banknotesync.com
alexandre-boissard.com
valorartetattoo.com
savetheverse.com
specificpcshop.online
h0jt1y.accountant
jiqing3.com
alfaranakle.com
saft-store.com
wanderingcollective.com
santandermobi.online
557023.top
loulancaster.com
vedattelekom.com
jatinangorcity.com
goldencanaries.com
edgaralanbro.com
levelretail.com
taylorsandbek.com
upbeatnewyork.com
motoreselectricoschihuahua.com
hotair.wales
getawomantodoit.com
xiaoxiong365.com
cloudboxsupport.com
vecteur-u-shop.com
fex-tracks.com
Targets
-
-
Target
yeni sipari?.exe
-
Size
648KB
-
MD5
9db7619bc23ec15cc6863948515acc4e
-
SHA1
90e5b2e78d2bcc1f6d78ff9bfd9e1ca16b94c605
-
SHA256
c2100ac52466885fcb64010897d0c7a4178a5c00c47e13261f66976b38f26aaf
-
SHA512
6676f9434bc4e2f2fe3e256a328554162020e156c576b63eaa7ec2f79f834ecf967610c1dace77f1931f0fd2110aafff656eabe20a76bda8b610e06cbe27cf62
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-