General
-
Target
new.exe
-
Size
432KB
-
Sample
230216-1r1fxacc65
-
MD5
e3a874c6e454d2591f5380be7aa4dff4
-
SHA1
3714bee104682ecc3867aa84f9b049d3b6d58639
-
SHA256
9e804f046cb3978daaa84fe71badb3a5fef3aea5387377e3b05524cbb8092a89
-
SHA512
6eb235dfcdb612b4db9926275e827e179166e3522256de14b51da3fb6610fe610c6547c7eb29ceb3b95eebb434c68d9bf000e7d1a14320853363e0dcd0c0f93e
-
SSDEEP
12288:TY74I2N2tpc73OFMf0aHFJOJYT8htu8GIS1r7L:TY7G2tW731zHnOJYmE8Fq3L
Static task
static1
Behavioral task
behavioral1
Sample
new.exe
Resource
win7-20221111-en
Malware Config
Extracted
formbook
4.1
ho62
aqawonky.com
ancachsroadsideassistance.com
artologycreatlive.com
olesinfo.africa
lovebreatheandsleep.com
friendsofdragonsprings.com
homecomingmums.wiki
hg222.bet
precision-spares.co.uk
generalhospitaleu.africa
touchstone4x4.africa
dynamator.com
dental-implants-52531.com
efefear.buzz
bentonapp.net
89luxu.com
bridgesonelm.com
acesaigon.online
instantapprovals.loans
evuniverso.com
kasoraenterprises.com
instasteamer.com
granolei.com
iamavisioniar.site
beachexplo.com
ynametro.com
littlegallery-rovinj.com
27og.com
horrorcity.online
zexo.africa
perdeumane.com
drugsaddiction.co.uk
tickleyourfancy.africa
jimyhq.top
rajputnetwork.co.uk
lacuspidehn.com
bestxdenotecyby.top
gg10siyahposet.xyz
biorigin.co.uk
jye-group.com
digito.exposed
eternalstw.com
schjetne.dev
climateviking.com
easysaldoya.xyz
1233332.xyz
centerverified.online
lezzetyemekfabrikasi.com
wzshayang.com
cloudadonis.com
zxpz6.com
alifecube.com
induscontrolpcb.site
golfingineurope.com
ducksathomephotos.com
aimeesbellaboutique.com
justrebottle.com
hachettejeunesse.pro
238142.com
casabiancapanama.com
dohenydesalination.com
1-kh.com
cdhptor.xyz
island6.work
ehirtt.com
Targets
-
-
Target
new.exe
-
Size
432KB
-
MD5
e3a874c6e454d2591f5380be7aa4dff4
-
SHA1
3714bee104682ecc3867aa84f9b049d3b6d58639
-
SHA256
9e804f046cb3978daaa84fe71badb3a5fef3aea5387377e3b05524cbb8092a89
-
SHA512
6eb235dfcdb612b4db9926275e827e179166e3522256de14b51da3fb6610fe610c6547c7eb29ceb3b95eebb434c68d9bf000e7d1a14320853363e0dcd0c0f93e
-
SSDEEP
12288:TY74I2N2tpc73OFMf0aHFJOJYT8htu8GIS1r7L:TY7G2tW731zHnOJYmE8Fq3L
-
Formbook payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-