General
-
Target
bbgdf.exe
-
Size
899KB
-
Sample
230113-nj7tssge64
-
MD5
916671cc970dfecedd93b15e9f0283c2
-
SHA1
8d8f433571fc9ca455420383e0974f5161ee65e4
-
SHA256
610d8fe0411d6fda8b18984c1a2e5d6477cdb587d506b3e82fa189513a4a53ad
-
SHA512
a69bd989de0339224669a2cad602b93ce5f479647030e94789d6cd03014ac4a07b7c8bd4387ae3027dac9186343ddef99237731aa7e883491298c1472706b48e
-
SSDEEP
24576:Bb7gh/uy1RSwp0BWdcqyJ/d6pYd7jPGaVZxWQOp:Bb0h/X3/EWByJ/d6pYxGaVvWPp
Static task
static1
Behavioral task
behavioral1
Sample
bbgdf.exe
Resource
win7-20220812-en
Malware Config
Extracted
formbook
4.1
sr23
permanentstaffing.co.uk
agentecritico.com
alibabas.international
emserviceslimited.com
foodtourmarrakech.com
cossye.com
arrenmorden.com
evensbreeding.com
ig-group.net
bwin6789.com
gift-formula.ru
aaa-arts.com
lovecrust.co.uk
dmiqpnu.com
aarellano.com
kx2386.com
hubersheepequipment.com
goldentrianglecatering.com
libertyguide.info
codilitytech.com
bioktix.com
hatecrimesheartland.com
joseeblankenship.xyz
kanaspickleballassociation.com
desvurentals.com
hipayer.com
jianruimc.com
teamhomeschool.net
shinestore.uk
lexallen.co.uk
greenpremiere.com
blackforestgroup.co.uk
hbwejianzhan.com
stursulasplayers.co.uk
umhlangatowingservices.africa
aristorawpharma.com
bbqisme.xyz
family-doctor-69268.com
60067.net
xcmncmdd.net
wsuoob.net
managec.net
dbdictionary.net
burger34kumru.com
unusualbrand.net
foot-print.store
avito-kt.online
dogseizurestreatment.site
mayfair-locksmith.co.uk
nbemt.xyz
mofangtop.com
eltermklimatizacija.com
gamestopeurodeutsch.com
aitechnify.com
cristianlealojeda.com
vaca365.com
ziphost.africa
etiquetasya.com
ettric.com
93215.vip
libyanturkishhospital.com
dosculturas.online
browyum.com
elmpointapartment.com
weddingsonthewater.net
Targets
-
-
Target
bbgdf.exe
-
Size
899KB
-
MD5
916671cc970dfecedd93b15e9f0283c2
-
SHA1
8d8f433571fc9ca455420383e0974f5161ee65e4
-
SHA256
610d8fe0411d6fda8b18984c1a2e5d6477cdb587d506b3e82fa189513a4a53ad
-
SHA512
a69bd989de0339224669a2cad602b93ce5f479647030e94789d6cd03014ac4a07b7c8bd4387ae3027dac9186343ddef99237731aa7e883491298c1472706b48e
-
SSDEEP
24576:Bb7gh/uy1RSwp0BWdcqyJ/d6pYd7jPGaVZxWQOp:Bb0h/X3/EWByJ/d6pYxGaVvWPp
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-