General
-
Target
CREDIT NOTE.js
-
Size
47KB
-
Sample
220930-kceynadad4
-
MD5
771ee97bd2e61801d47f37b60a69d1c8
-
SHA1
b77ea83d939bc5ce8ceff9668488f8045ba58a0b
-
SHA256
25027a9677193ee152a6621382d40fcf31437b4366f6566d369f24d93f52f56d
-
SHA512
2ac19e006117d449467ec49f4b600293775bdbb0f03869a6e7c914449fb522d22f74ab060d0086ef1a033c91d987c38ddd97e258a7575581e95d68b1657737b1
-
SSDEEP
768:bH5hjkXAZJMdHG7TH8eA0oWz6nSwsmjX1uMW7/1W8eXBnKX2CzHsPOux4GsPje//:bH5hIwZ+dHk8n0ISwXZ8OBKX2yKCXlgT
Static task
static1
Behavioral task
behavioral1
Sample
CREDIT NOTE.js
Resource
win7-20220812-en
Malware Config
Extracted
wshrat
http://3lv15.duckdns.org:6697
Extracted
formbook
u8ow
j5a7vTwyeK/qHg==
M2qzs6QwZ5sVSqCc
7KoU1t9NdRnqZ8ML+cB8x38C
pgeKvdoqNNao7Cr94QiDuw==
/QZJhRORtafU/zeqK4o+
2JvqeTAGpQBYdqgXoA4=
5zJ7fa0A0PgCFA==
cnq44WjiBQ5VfKgXoA4=
oAp6hcdNVbr2NaHk4QiDuw==
Z/w2v4V/zV8aVoFnW0zzSt6hYjbD
WJ74K7ehJCNed6gXoA4=
hCRY0pmWSLhPzeTztw==
ZNhbVFvL8KKYyj2udtFXr3U8T6LZeQ==
ur75Bj2XjwVNhAGA
BlhiocrRF/kDFg==
aQY19Du631WFpEg=
yGCGEReSv1T1JVmWfHwp
cvso1tUbJeLrMlhjg4Z8x38C
XmTsffB+q25IYuOWfHwp
ry8fNm8E0PgCFA==
jpTC1EEMl8QsavylFo5Pn0XkR9HHtaw=
VVqBje/QWFipzFCNkl4sY4pzgFfL
vlWFIwZNUbxGXaij2E/PZ4RAT6LZeQ==
ZoKpx1VFx7v+RaPo4QiDuw==
H+M67QcOr9mm7l8=
eQgtxbcUPuSn4jlrfFbyT+GhYjbD
v8JQ+9lJeRvsL2fOuK9ZqVc=
EaLpmYiCMWUbjiCIup0h
Yq7zIaB3CwTHCYOS
e8QMNY/c8gWHsPn6/sJ8x38C
4qTUS/7ZXakxTpeXoZJ8x38C
5LALqHx4yFsEAw==
4n/CPfjjjwzKElNp44lbXV8=
nCNkIig/o0r+
7N63YHLe+8PHCYOS
S8Yv9Wvh64kDYoWF
VeYjqV804l7zMXQpwxM=
cr3GEFvhA6lYke8fqlIbK0sIQDZ+bdYn
KyqoLc3IbbQ7fqgXoA4=
+4gcGx0XujvyPpz5lRQx95FBT6LZeQ==
8vs6RY0S+P/uCQ==
0bgirl055FC1y0esWtbc64II
tUdqFCGRwGYzVoTz+CWJvQ==
I54qU23I75EDYoWF
M2mktwhxo6v1LlUlSEP0VeKhYjbD
UhF3C7WRF24ybI26eGkj
PUa3QvTcZq9KhwVGp0Y5MoEE
mJEVnfxTfoC95gPyhg0lLIk6Cg==
yoLNVw3plASw0yCgLqgs
Jt8Kqrm+NW7N9EDrlQQ=
gspPeq8JNjpDUoNn8X07QFU=
L8b5eiv1sWY5YOaWfHwp
4O6FBIV3K4QMJnO6lJk3
c74fNVa23o5VaNP84QiDuw==
m3vyQyWVBcGRpCSN
cwgrursqO+GwxkSq1sVlrXU8T6LZeQ==
NAJyMT1E6m0sc830BggoPwr4VpQ=
67D3oH1S6G5gkvIyRCi6RWQ8T6LZeQ==
yMo01aycP6gxX8kUTUPvZ4lUS5rUcw==
EipNd9xKbSPwMGdpdaEgS0g=
cCySPxoLstmm7l8=
l+pYdpbs3OfvFg==
kOpdbJ+0/+sqqavhoA==
swqGvwuDv8HvBDeqK4o+
avdoga.net
Extracted
xloader
3.5
u8ow
j5a7vTwyeK/qHg==
M2qzs6QwZ5sVSqCc
7KoU1t9NdRnqZ8ML+cB8x38C
pgeKvdoqNNao7Cr94QiDuw==
/QZJhRORtafU/zeqK4o+
2JvqeTAGpQBYdqgXoA4=
5zJ7fa0A0PgCFA==
cnq44WjiBQ5VfKgXoA4=
oAp6hcdNVbr2NaHk4QiDuw==
Z/w2v4V/zV8aVoFnW0zzSt6hYjbD
WJ74K7ehJCNed6gXoA4=
hCRY0pmWSLhPzeTztw==
ZNhbVFvL8KKYyj2udtFXr3U8T6LZeQ==
ur75Bj2XjwVNhAGA
BlhiocrRF/kDFg==
aQY19Du631WFpEg=
yGCGEReSv1T1JVmWfHwp
cvso1tUbJeLrMlhjg4Z8x38C
XmTsffB+q25IYuOWfHwp
ry8fNm8E0PgCFA==
jpTC1EEMl8QsavylFo5Pn0XkR9HHtaw=
VVqBje/QWFipzFCNkl4sY4pzgFfL
vlWFIwZNUbxGXaij2E/PZ4RAT6LZeQ==
ZoKpx1VFx7v+RaPo4QiDuw==
H+M67QcOr9mm7l8=
eQgtxbcUPuSn4jlrfFbyT+GhYjbD
v8JQ+9lJeRvsL2fOuK9ZqVc=
EaLpmYiCMWUbjiCIup0h
Yq7zIaB3CwTHCYOS
e8QMNY/c8gWHsPn6/sJ8x38C
4qTUS/7ZXakxTpeXoZJ8x38C
5LALqHx4yFsEAw==
4n/CPfjjjwzKElNp44lbXV8=
nCNkIig/o0r+
7N63YHLe+8PHCYOS
S8Yv9Wvh64kDYoWF
VeYjqV804l7zMXQpwxM=
cr3GEFvhA6lYke8fqlIbK0sIQDZ+bdYn
KyqoLc3IbbQ7fqgXoA4=
+4gcGx0XujvyPpz5lRQx95FBT6LZeQ==
8vs6RY0S+P/uCQ==
0bgirl055FC1y0esWtbc64II
tUdqFCGRwGYzVoTz+CWJvQ==
I54qU23I75EDYoWF
M2mktwhxo6v1LlUlSEP0VeKhYjbD
UhF3C7WRF24ybI26eGkj
PUa3QvTcZq9KhwVGp0Y5MoEE
mJEVnfxTfoC95gPyhg0lLIk6Cg==
yoLNVw3plASw0yCgLqgs
Jt8Kqrm+NW7N9EDrlQQ=
gspPeq8JNjpDUoNn8X07QFU=
L8b5eiv1sWY5YOaWfHwp
4O6FBIV3K4QMJnO6lJk3
c74fNVa23o5VaNP84QiDuw==
m3vyQyWVBcGRpCSN
cwgrursqO+GwxkSq1sVlrXU8T6LZeQ==
NAJyMT1E6m0sc830BggoPwr4VpQ=
67D3oH1S6G5gkvIyRCi6RWQ8T6LZeQ==
yMo01aycP6gxX8kUTUPvZ4lUS5rUcw==
EipNd9xKbSPwMGdpdaEgS0g=
cCySPxoLstmm7l8=
l+pYdpbs3OfvFg==
kOpdbJ+0/+sqqavhoA==
swqGvwuDv8HvBDeqK4o+
avdoga.net
Targets
-
-
Target
CREDIT NOTE.js
-
Size
47KB
-
MD5
771ee97bd2e61801d47f37b60a69d1c8
-
SHA1
b77ea83d939bc5ce8ceff9668488f8045ba58a0b
-
SHA256
25027a9677193ee152a6621382d40fcf31437b4366f6566d369f24d93f52f56d
-
SHA512
2ac19e006117d449467ec49f4b600293775bdbb0f03869a6e7c914449fb522d22f74ab060d0086ef1a033c91d987c38ddd97e258a7575581e95d68b1657737b1
-
SSDEEP
768:bH5hjkXAZJMdHG7TH8eA0oWz6nSwsmjX1uMW7/1W8eXBnKX2CzHsPOux4GsPje//:bH5hIwZ+dHk8n0ISwXZ8OBKX2yKCXlgT
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-