General
-
Target
44ff207640bbc0f8e26c8107eff9e833855e423bdf5807cd984a4c29280d000d.exe
-
Size
238KB
-
Sample
230106-ry5jrsce8z
-
MD5
a5ec1b4efda3e05a43d9c6dab3ccc4a2
-
SHA1
2a4d2c1d0f81a84dca80def53b14e4abc13aaf4f
-
SHA256
44ff207640bbc0f8e26c8107eff9e833855e423bdf5807cd984a4c29280d000d
-
SHA512
207983c374065b8d00ff8af546196607df659dab6588af0bde8939876086f7df14dc758c07b5a45bd800d53272d7a60c4a8ecb30e4f519b0b5feff5139c5ea65
-
SSDEEP
6144:QBn1DvF4M1wfKlMdnsvgLNoqtt56q5Gk6ZiY+gXZPh5Cmfv:gDyM1wf4MdsvgLNBGlZijgXZCMv
Static task
static1
Behavioral task
behavioral1
Sample
44ff207640bbc0f8e26c8107eff9e833855e423bdf5807cd984a4c29280d000d.exe
Resource
win7-20221111-en
Malware Config
Extracted
formbook
e97n
4Xbmlf4Wz55x7dBOEmtQyFwtSps=
OLp2RsYukIPkITxtccwv2fe5
f1MAs8NA5LUmq7OyfvI=
gFqE4kIySuWHjVrs
QeIIp+JSHO+5DeZbJLcHvVwtSps=
6aE2SCTfXCyOldv+2Ei/5wjfQBFoMxof
nxcqgQLKSwuf/LOyfvI=
Sf+semqUcO2HjVrs
Ft2Jqlk96tet/rOyfvI=
Q8A89YVLuGz5Pe1TFRJyKw==
5qFKEn+IST4aXvnsZX2o0Kk=
wo0yVAbvDEjvH+F1OLUGvVwtSps=
H/I+vwAeCDs+jPtWAC+uUaE=
M+Whsueg7XkSqp80OXfElLY=
Yt1RU/floa+TstxEvg==
jPfgICXIBIjqRjPDmv8v2fe5
17iFkU9JCrMHHoCiPH/ewu0sCVfyQw==
qx8QmzUAiVfnINpTFRJyKw==
exm9h/H8tpOaz4/Z5EY4
uF8D4ldjazE6xw==
rmIZI1LdmimI
45cTMGKcd+2HjVrs
95TOII6tbj0XpYrsapqQFm+JmXt/3Lz6YA==
AqtxJaBKpLMLNpz7
kH/OBguu627eF2WKXcLQHo71LQ==
Wff7MhpGJ78jWbbkpxhTFZcom72zSw==
dvXsrqsxZOBCi/bZ5EY4
nw0HVUPRMLKjstxEvg==
7MRONm3nNbqrKbE=
D8imby7bVQoQL6Y=
khMHk9NNfs0rsnbGSYSXpF/0NjE5
NfMXU1GVkB2UDNw2FImy4u30NjE5
bS9dnYi4rfLU3tMliOU=
jlYR9Ch4zUmV
EdMXZ9U11Xuf
AHfrqv/de0sbO5u4jxlKZR9r47a/GAA3fg==
NQ+3vpMtiJyEt3MBb7rHqciFNQEk
xaFUXo3PtjeW2C1mFRJyKw==
oU+U9muQZoJy2MtOFRJyKw==
/aMSNGK+c3d/DQGbZN8mylwtSps=
xUc2umWYqWY2b78=
U+zUZ7VGmCGJ3UehNHzbwu0sCVfyQw==
aBXfgva8LkozeNf6vjOA1uSjEeNAeAgI
2KHPHCFwfyGqKN4a8i+uUaE=
TKkp7nAkqJQmrIzZ5EY4
B5OJFrHUlmqV7dU9vA==
7IBuALFqvplx/N5Q/y+uUaE=
VhfYnH0MTNxRmxeSTcINw1wtSps=
gkCwOEGrhCDIsBZX4tT5694QSrO5GAA3fg==
uj5C6p1l8MUljl7ATi+uUaE=
z4/fVpIOr7zmdmbx
fRR1ikwnJGxgstxEvg==
fR4gcmHOWiOxAbOyfvI=
ceBEUhUn9Pj0GORY4AciMnH9MA==
RLqy7OovY2pe2g==
DouFFl7uMosSVqPTVab3qMGg
B3WE0kZkIv3jXBZhFRJyKw==
CpGPD9APFlovXnztd7CzIw==
EoIO1ktpazE6xw==
6qPUFedaftA0sbOyfvI=
8l9Zo6HMoCCl9C68gw1ak1/0NjE5
I/+6r1MoGrdZS6XLigcw
Gqmo43ddcMGgxC5Cy/ov2fe5
E9aGi1E7lcSc9c1DOy+uUaE=
quirkpanda.com
Extracted
xloader
3.Æ…
e97n
4Xbmlf4Wz55x7dBOEmtQyFwtSps=
OLp2RsYukIPkITxtccwv2fe5
f1MAs8NA5LUmq7OyfvI=
gFqE4kIySuWHjVrs
QeIIp+JSHO+5DeZbJLcHvVwtSps=
6aE2SCTfXCyOldv+2Ei/5wjfQBFoMxof
nxcqgQLKSwuf/LOyfvI=
Sf+semqUcO2HjVrs
Ft2Jqlk96tet/rOyfvI=
Q8A89YVLuGz5Pe1TFRJyKw==
5qFKEn+IST4aXvnsZX2o0Kk=
wo0yVAbvDEjvH+F1OLUGvVwtSps=
H/I+vwAeCDs+jPtWAC+uUaE=
M+Whsueg7XkSqp80OXfElLY=
Yt1RU/floa+TstxEvg==
jPfgICXIBIjqRjPDmv8v2fe5
17iFkU9JCrMHHoCiPH/ewu0sCVfyQw==
qx8QmzUAiVfnINpTFRJyKw==
exm9h/H8tpOaz4/Z5EY4
uF8D4ldjazE6xw==
rmIZI1LdmimI
45cTMGKcd+2HjVrs
95TOII6tbj0XpYrsapqQFm+JmXt/3Lz6YA==
AqtxJaBKpLMLNpz7
kH/OBguu627eF2WKXcLQHo71LQ==
Wff7MhpGJ78jWbbkpxhTFZcom72zSw==
dvXsrqsxZOBCi/bZ5EY4
nw0HVUPRMLKjstxEvg==
7MRONm3nNbqrKbE=
D8imby7bVQoQL6Y=
khMHk9NNfs0rsnbGSYSXpF/0NjE5
NfMXU1GVkB2UDNw2FImy4u30NjE5
bS9dnYi4rfLU3tMliOU=
jlYR9Ch4zUmV
EdMXZ9U11Xuf
AHfrqv/de0sbO5u4jxlKZR9r47a/GAA3fg==
NQ+3vpMtiJyEt3MBb7rHqciFNQEk
xaFUXo3PtjeW2C1mFRJyKw==
oU+U9muQZoJy2MtOFRJyKw==
/aMSNGK+c3d/DQGbZN8mylwtSps=
xUc2umWYqWY2b78=
U+zUZ7VGmCGJ3UehNHzbwu0sCVfyQw==
aBXfgva8LkozeNf6vjOA1uSjEeNAeAgI
2KHPHCFwfyGqKN4a8i+uUaE=
TKkp7nAkqJQmrIzZ5EY4
B5OJFrHUlmqV7dU9vA==
7IBuALFqvplx/N5Q/y+uUaE=
VhfYnH0MTNxRmxeSTcINw1wtSps=
gkCwOEGrhCDIsBZX4tT5694QSrO5GAA3fg==
uj5C6p1l8MUljl7ATi+uUaE=
z4/fVpIOr7zmdmbx
fRR1ikwnJGxgstxEvg==
fR4gcmHOWiOxAbOyfvI=
ceBEUhUn9Pj0GORY4AciMnH9MA==
RLqy7OovY2pe2g==
DouFFl7uMosSVqPTVab3qMGg
B3WE0kZkIv3jXBZhFRJyKw==
CpGPD9APFlovXnztd7CzIw==
EoIO1ktpazE6xw==
6qPUFedaftA0sbOyfvI=
8l9Zo6HMoCCl9C68gw1ak1/0NjE5
I/+6r1MoGrdZS6XLigcw
Gqmo43ddcMGgxC5Cy/ov2fe5
E9aGi1E7lcSc9c1DOy+uUaE=
quirkpanda.com
Targets
-
-
Target
44ff207640bbc0f8e26c8107eff9e833855e423bdf5807cd984a4c29280d000d.exe
-
Size
238KB
-
MD5
a5ec1b4efda3e05a43d9c6dab3ccc4a2
-
SHA1
2a4d2c1d0f81a84dca80def53b14e4abc13aaf4f
-
SHA256
44ff207640bbc0f8e26c8107eff9e833855e423bdf5807cd984a4c29280d000d
-
SHA512
207983c374065b8d00ff8af546196607df659dab6588af0bde8939876086f7df14dc758c07b5a45bd800d53272d7a60c4a8ecb30e4f519b0b5feff5139c5ea65
-
SSDEEP
6144:QBn1DvF4M1wfKlMdnsvgLNoqtt56q5Gk6ZiY+gXZPh5Cmfv:gDyM1wf4MdsvgLNBGlZijgXZCMv
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-