General
-
Target
72be1dd76472cba29a36135e882526fe.bin
-
Size
803KB
-
Sample
230312-bs75pscb96
-
MD5
36bd9a2e2a004308d6d0fd3f026bc45d
-
SHA1
23954ca0385015f8d545e994211e34248b21f53a
-
SHA256
52b2e3ee96bb0578fc6bbe7bf5a0f61e642e081169b9e399647293879a19a94a
-
SHA512
524b5ba3d404486113f65f2cfab3604698f37db75161e515f5345399fd790ad09fb90ed80a458ac7c941b31f3c1cf9dacad45b8b5daf0f06fc6e03c780aa7920
-
SSDEEP
24576:MhaBCKT+SyBtdCEoEXa1Ol5EHzgQuWIsbh:MkT+S6rCEdll50zJD
Static task
static1
Behavioral task
behavioral1
Sample
6fb6a2160d5ceeef3420d09b7156d35e403ba7098bc0bdcadc9e721de1b3d5af.exe
Resource
win7-20230220-en
Malware Config
Extracted
formbook
4.1
h3sc
seemessage.com
bitlab.website
cheesestuff.ru
bhartiyafitness.com
bardapps.com
l7a4.com
chiara-samatanga.com
lesrollintioup.com
dropwc.com
mackey242.com
rackksfresheggs.com
thinkvlog.com
aidmedicalassist.com
firehousepickleball.net
sifreyonetici.com
teka-mart.com
ddttzone.xyz
macfeeupdate.com
ivocastillo.com
serjayparks.com
uptimeps.cfd
prioritivity.com
linjia.cfd
rentmobil99.com
amazonpublicationhouse.com
wisconsinprivatelenders.com
emavgrfcolvin.click
navegadornet.tech
extremetension.com
hpm8cnb5s2vqr.com
sxhjdp.com
breathevitality.com
easyshopalgeria.com
profibex.com
3546464356.top
shopanml.space
andhra2telangana.com
b4pizzeria.click
thehealingcoaches.com
theantalyas37d.com
tyuuhai.site
look.fashion
zbzhaochang.com
emmettis.com
data4u-e.shop
dawnzdesignzz.com
modulatic.com
measuremateshop.com
5starseptics.com
zexalin.top
r693.xyz
techcryptoreview.com
singiteasy.store
portpay.site
holmtransport.com
zkdwvtg.top
nonetdc.xyz
customerservicesafesteptub.com
myhandmadeheaven.com
prostockdirect.store
vppq.buzz
malibu5.com
alexfallah.com
93oo.top
illatales.com
Targets
-
-
Target
6fb6a2160d5ceeef3420d09b7156d35e403ba7098bc0bdcadc9e721de1b3d5af.exe
-
Size
948KB
-
MD5
72be1dd76472cba29a36135e882526fe
-
SHA1
be4b041b0c21162e389f4a9a1620fda5e0050713
-
SHA256
6fb6a2160d5ceeef3420d09b7156d35e403ba7098bc0bdcadc9e721de1b3d5af
-
SHA512
67ed20a8ba6c464d2abccf06b6a1af5215645a8812672f39b499ae52419b361d74065ebcfe3f9fb933722969619fb17e298a53898551953b00bc5c620e5587bc
-
SSDEEP
24576:jDKmIirBQVM3P06E+eaioYJjkVxOCAEzh:j2mIqq6fqBaioY2oCAK
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-