General
-
Target
27bb66e7e3ff9b2094fb568e243c1d20
-
Size
307KB
-
Sample
230321-gf9ewsah7z
-
MD5
27bb66e7e3ff9b2094fb568e243c1d20
-
SHA1
58ccfc20f2240af3bf98fc7121cfafb0c2a6f833
-
SHA256
9223ea1f88d99f8c593d7f8b888df49378bbdad7ba3a3a21cd762ea390f7c28d
-
SHA512
bc7e55c3bb2fbd5ffe58ef69b935b26ce0e893a37ac038733420b8335bce06a2a7beebde745760586a309af0bdadfc42c444f8d6e7d7886b0e2c10858d17d1f2
-
SSDEEP
6144:/Ya6/om87RH3+UAHQlFVTgy0vSRyPtZQA39ee8GDKkNKpd2DryescPi:/YdoV7p3MuF9WKIPtZb97DKfp1Aq
Static task
static1
Behavioral task
behavioral1
Sample
27bb66e7e3ff9b2094fb568e243c1d20.exe
Resource
win7-20230220-en
Malware Config
Extracted
formbook
dcn0
ZVx68vDtAMBCwg==
oBMBvsNORkM/O/ox
Ff9pISWkm6eG4lByIspp
c2T42c6CIIF6B8xTxm9XzpVw
bvjhxRbnAC183w==
0lTttSNG4HUDNflyIspp
hPXFlstqiHA/O/ox
WLR+MeerxZ0cNn1ja+IQAYo=
IHRn4xXOVKi477zarG+ObSy7YJA=
Xhf3e+tdAC183w==
Xk0ZAezv2rWH
kngo+vBeSRN7AszNwam3Osmguuqc0MoC
a2Qp7a+E8fSw7LDjpnqEKjsRZA==
3zjy4E7+QM48wg==
YcCmqT3OUNAigVott2pBKiy7YJA=
4+SMeX1juat/5cZ1AZihcyy7YJA=
/+m7sro0OBTl3TMpCw==
i2ctEfe4//a64yklMsgS2J90
+loZ2QKGX0UWgpvErMs=
b9BNCnJWQJS8IfsR0uR3bCy7YJA=
9eiUYE0ynHE/O/ox
F2/75pOIYNg0hzOD99192J8=
Y1xOONdO105okfha33EZ2A==
qYZIIB+dfF0wp1nVWFz067hJ2/qoXEVeAA==
moQMzat7tfKyKPYs
aMZJI/NfUSSpPQUBJ8/11g==
QKMN15GjpHcpyA==
6+S1hTvphhFfoCdj6tw=
DPynhWcnZWho7a0p33EZ2A==
EXY//zDm7ej3Guwo
PSWxPYkk0SNioSdj6tw=
jv+tmhv1ySZloydj6tw=
P8GUV5BhNZflCCBBFg==
IQZ0PWog1lcVVkJYHg==
aOTCq/Cet6AdhSdj6tw=
OBzJrqYS+eac46nZo4aI84kWMEtH
kBzTkbI2LTo/O/ox
a8pwOrU/tyx93a/QrGBpXGQIfZI=
GWoC9K5Mx0GR34urFcDPyQ==
dGxKGM2FI4iAkTOD99192J8=
UqQv8Vkx7WzkCCBBFg==
NcBsPK+YmdZP0cyhY+Lrzw==
zcKbk5oK7NCgFOpa4tHv0g==
uIomFkUTzdWa
QkAF8NuWMZmnPjCFgJBa+Y1t
51w6Gw7c3NyY
IyDnsW89dXaMrAxotF8jGZc=
1s1RHCrCwI8PnVhMY+Lrzw==
zBnRazUUWCsrM5t0SEth
1z4R/XM98Wn3j1RMY+Lrzw==
h3b34yQL3cI8wg==
/+27PhUTzdWa
CO0jnOIoAC183w==
Cn8jz+pyZEfWCCBBFg==
jI4f4NnKFwoSUb4YbnkzePzLv+Sc0MoC
xZnrS1Y+5Sxv1g==
phjYsTTGW8zAMydj6tw=
v7JcJyW3x64phzOD99192J8=
tBJ+Uh3sJxYqbyvrfF6BKjsRZA==
xRTxyfuTgMhGxg==
6ceNTfir2qmQHtxWwqIrI8GQ7h/Te/A2CA==
00gVx7d5/U5soCdj6tw=
Jgvgt58H8MFLfBzTp1VZXCe2ZYg=
1NKRY1QTzdWa
ahmedo.ch
Targets
-
-
Target
27bb66e7e3ff9b2094fb568e243c1d20
-
Size
307KB
-
MD5
27bb66e7e3ff9b2094fb568e243c1d20
-
SHA1
58ccfc20f2240af3bf98fc7121cfafb0c2a6f833
-
SHA256
9223ea1f88d99f8c593d7f8b888df49378bbdad7ba3a3a21cd762ea390f7c28d
-
SHA512
bc7e55c3bb2fbd5ffe58ef69b935b26ce0e893a37ac038733420b8335bce06a2a7beebde745760586a309af0bdadfc42c444f8d6e7d7886b0e2c10858d17d1f2
-
SSDEEP
6144:/Ya6/om87RH3+UAHQlFVTgy0vSRyPtZQA39ee8GDKkNKpd2DryescPi:/YdoV7p3MuF9WKIPtZb97DKfp1Aq
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-