General
-
Target
8ec772a1c6a1a4dfb337cdcfb361d611.bin
-
Size
725KB
-
Sample
230325-b33yqscf2w
-
MD5
9de65ed4f24d0caf47aa0e6a53cf9a9c
-
SHA1
6d4e21868f5005e1b2784b016ee0b20ce37b2250
-
SHA256
4d7d3d372aed8f49e63bd08ffa1aac8e3c46cfd4c58f82ad00c94eaf8eac5bc5
-
SHA512
e58bb7fe5c46be136b38de242dbd76655670a1b4f7ffeb89591194803035533892b2d08b1d6f500d876492c9995ce02699ea7bb78c00f198d35889d4154f83d6
-
SSDEEP
12288:egLdWnTMChDTKjQmIIYy1T5jaBxCY+XBacGyrpOSg/1Wrl8QNkLyPq4XSw8AFG41:eC4nAhFIIYy190xC9RacGyFOdS8QNkLy
Static task
static1
Behavioral task
behavioral1
Sample
customer's Scan-Copy.exe
Resource
win7-20230220-en
Malware Config
Extracted
formbook
4.1
dr62
juanbrujo.com
toptasker.africa
g-labs.one
1redbuckpermonth.com
lasolutions.online
beginagainmen.com
iearn.site
leading-car.ru
codigosindiabetes.fun
6y8ud.bond
fptmarket.shop
ctjhxv3.vip
huluxia2.xyz
piggg08.uk
kms-pico-tools.com
westonandcate.com
giftrendz.com
kqwdhrendfywefdst.top
anchitchoudhary.com
sistemodasi.net
dotcomsolutions.co.uk
anastaciachetty.com
czh.ink
complete-energy-performance.com
kollanjurarna.se
anotherdaythelabel.com
fengkoo.com
sunsongproductions20.com
horhog.com
chq-1.com
cryptogame.rsvp
jjzb10a.xyz
raffletokens.com
djmikehall.com
baychocolates.online
ecoskiusa.com
myenergyusage.co.uk
lipcarehub.africa
isstrainingaz.com
engagementbuzz.com
jordanheritagita.online
cheaphockeysticks.com
rodeosonline.uk
access247connect.info
85putao.com
josefa.wien
pilcoh.online
apothakeehair.com
danadelseck.com
dslimme.com
alacatimacunu.com
caplesssociety.com
creativeirishgfts.com
blografie.com
hamfoods.com
ballonstunisie.com
jingduxueyue.site
goldoholic.com
millennialcore.net
tacairservice.com
betheme.shop
bathroadtraders.co.uk
jas757.com
crossovers-82617.com
573415.com
Targets
-
-
Target
customer's Scan-Copy.exe
-
Size
963KB
-
MD5
f5672b8f33b37682573f37a197ef1c19
-
SHA1
0517ec9f5cb34d0c2568e3c2cd1a0509a1baeb43
-
SHA256
f9aca991af8ac33fee207fee13a29f070930ea35a4f375ebd3300604510bfd23
-
SHA512
c1df6765a6d959be0e0d85f9fcf588b094b66381feae10e203d917cc95d93c0913f5f4fdcd46bcc9bd526ad75226743571fb6a868dd537af9d37325070d7a1be
-
SSDEEP
12288:sQoyPF2JA83DPaCTFhFlnT8jcZf8hesy5SHu5CZPpVDmrdJ1aOIOb9utEcbN2lfR:sQo4I+8TiY3Zf5tjrDhb9sEc8Ni
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-