General
-
Target
Confirmation transfer MT103 Ref_008675323.js
-
Size
342KB
-
Sample
220921-rwaavageb7
-
MD5
fb5bd94adf05e82a5cf7a928322d7684
-
SHA1
916128a1be6377ac07a23281f14952df5b6c18c2
-
SHA256
68f066d3252585c2776822a48a9e0aa52c066bc8bdd6be03b3f9e27f0e0c098b
-
SHA512
44be5454b24f9e9cfee04f59e90f0313cfe6cc48989a09dd6857a704d6e045b654c513ff1ac656fa4247ec3369684e926bd290397d32ce33ff00aab0e67d5ebe
-
SSDEEP
6144:OXaP+gpL6oJyS6iud3zxacILdfyTUUYlni2tjvZg7jp:0amJgOd1acoR1TtjRYp
Static task
static1
Behavioral task
behavioral1
Sample
Confirmation transfer MT103 Ref_008675323.js
Resource
win7-20220812-en
Malware Config
Extracted
formbook
q4k5
jQYgo8tIgmIc0mvpRb5x
WvKdh53xC7N4gDV7C595
3NZvdu4YVUEvB7v2l0Tm0SVv
/VRXhfIvRiNV3GOoZZPqieXuTd/oHzo=
iVrRnM8RfE8pow==
p7pocu0vag2HQeAi1Q==
jE3wz8cIIck7DaIRQns7/WM=
idYEkVhfx4USLm44
xQpoZwWMqZQZ0b+uff0=
1u0SiknP4Ls7GLQCxkszuinYzQ==
AVuV9lyovZ0am5kw6fg=
KicecBSZtmieUd7hkUDm0SVv
pMHRHY3n/dVlLQxECMx3
dE8S684NNa9pRNo=
2WKRICBuhDoNkuozMWGBGWPpliRqjw==
UnIpN/4ONxpFwu04CF57Ew==
lzTU5CR1jj6os+3Myg==
WR8IgU/HRPwvtA==
eACJW4jpYgiATdg=
BRYZUYK51HygS5kw6fg=
LCy5lutRkm/boz63mHIT7Bdp
OqnALPb+Yxrj
H7Ao9RaCr44SLm44
TdNqd8EUIQrVcJbmqns7/WM=
Ovh7T2DAyzk9G2c6
qHIM8wdzl2to+B9TLJbmqg/UzQ==
H7pNFDCV1ui2htKxcwbJnejwTd/oHzo=
vNT0V7UQMPRcGsM27gaYnNIT0g==
sulKq9weiSt0Hw5LcgU76gziliRqjw==
1i43j3PZBtqpen2SMLdz
xgX+Ty6gxXwgxm7pRb5x
dZW4RxqC4FRKvg==
nW0wETKj1MCEU/pDCF57Ew==
nVPCqNIVLga9Qkoq6opYA1Jc+wxo
NzRD0pr2N+UgpP49
b36rGb4ZWFA3y9zpRb5x
MfSCS2TYC/JySlsy
zQoyun3TCevkZrANJGb0qcYLERg=
2425INnkRPwvtA==
ol/Wnt1Jd3ItttLpRb5x
icUqei5ulVPrZ6L8t4xXF2tfq9bzUTqO
CkFeyHPpBuUbtPc/CF57Ew==
pzjDkYLH/O5ySlsy
KQa3w5OIQq9pRNo=
grzaa1nD9enouEzpqsRm
ZwSafJT5CO7mpC1gCMHReNKBi+VCthwmvg==
kMhzfwEvQfGqmTgv
ucrZKckZL9WDHjoOxCNQ+3Q=
LP6rl+oWWU8/EVIbqT5lFnJhrtfzUTqO
mvISpafy+9fLbHdC5Grm0SVv
UvqttwVjoo8H2xbmNLV5BA==
sz/iv8A4bS/jgJBiZmVlLIjzW2p3+R+E
jIiL+ZT5PCRYCK8saSbCuSSOAQ1g
FtWAh9IfPCayN3bZpXs7/WM=
1iNCt2Owt4vAfsLM738660xc+wxo
ZrC6CvFpxFdKtg==
rUHmxsf+Yxrj
Vy7Kg3zD6MuPMWjH93Lwp8YLERg=
vnsaLokBOjDaXpjzrHs7/WM=
+ZTHTkqDnQvEOllP739xDQ==
S2aA6IL1Ixx9PvN0xdqFRY+lpt/oHzo=
nKJEMVCmv3knrcJBGa1pKWs=
Dd7SLM9GsFSeMTwX1Q==
u3f82UW79J1PGrwW2A==
4222e.com
Targets
-
-
Target
Confirmation transfer MT103 Ref_008675323.js
-
Size
342KB
-
MD5
fb5bd94adf05e82a5cf7a928322d7684
-
SHA1
916128a1be6377ac07a23281f14952df5b6c18c2
-
SHA256
68f066d3252585c2776822a48a9e0aa52c066bc8bdd6be03b3f9e27f0e0c098b
-
SHA512
44be5454b24f9e9cfee04f59e90f0313cfe6cc48989a09dd6857a704d6e045b654c513ff1ac656fa4247ec3369684e926bd290397d32ce33ff00aab0e67d5ebe
-
SSDEEP
6144:OXaP+gpL6oJyS6iud3zxacILdfyTUUYlni2tjvZg7jp:0amJgOd1acoR1TtjRYp
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-