General
-
Target
abca758df173419c3a31ec19bfbea8ad.bin
-
Size
647KB
-
Sample
230512-cf1qjabc84
-
MD5
0670608b2892e06e985bcf97c8d1e809
-
SHA1
23390ce8efcabd402b3d063dc41c63dcf300cac4
-
SHA256
760c432baec5358149890326446a8b14541912773142b89f4be2a7e8a6811537
-
SHA512
f5564e6ef5b3b58b58cd5b966a45ac9c7de30c647cc21bea285598632ab1acb499fc36d6e5bfa80a1868ad4e0378cba17d5ee91a0d6537a170e0bcb35a39e9e2
-
SSDEEP
12288:o7HcT+yJVr4rB0JMqYix5D26LDqH7Zo4intIvzxFhuMLVg21Zf:o78zFemJi0FjLDKMntIv1FhJV35
Static task
static1
Behavioral task
behavioral1
Sample
PI.exe
Resource
win7-20230220-en
Malware Config
Extracted
formbook
4.1
m82
jamesdevereux.com
artificialturfminneapolis.com
hongmeiyan.com
lojaderoupasbr.com
yit.africa
austinrelocationexpert.com
saiva.page
exitsategy.com
chochonux.com
klosterbraeu-unterliezheim.com
byseymanur.com
sblwarwickshire.co.uk
brazimaid.com
ciogame.com
bronzesailing.com
dwkapl.xyz
022dyd.com
compassandpathwriting.com
alphabet1x.com
selfcleaninghairbrush.co.uk
power-bank.co.uk
kickskaart.com
baumanbilliardsnv.com
bestcp.net
doghospitalnearme.com
mixano.africa
helarybaber.online
illubio.com
ciutas.com
ldpr33.ru
killtheblacks.com
cassino-portugal.com
danhaii.com
gvtowingservice.com
let-travel.africa
dental-implants-67128.com
facetaxi.xyz
ctjh9u8e.vip
kyosaiohruri.com
executivepresencetrainer.com
greatharmony.africa
feelingsarereal.com
devopsuday.club
happiestminds-udemy.com
fittingstands.com
happyhousegarment.com
24daysofheaven.com
herhustlenation.com
xn--oy2b27nt6b.net
hothotcogixem.online
hausmeisterservice-berlin.net
hjddbb.com
stoutfamilychiro.com
bookishthoughtsbychristy.com
gibellinaheartquake.com
8cf1utrb6.xyz
patrick-daggitt.com
ebcbank.net
angel909reviews.com
arcteryxsouthafricaonline.com
cutematvhy.com
art2z.com
bulkforeverstamps.com
heatbling.com
despachocontablequinsa.com
Targets
-
-
Target
PI.exe
-
Size
773KB
-
MD5
fe3365e83f4a43d63e0394450e1e284d
-
SHA1
f36a3148c6220bb10b0c828cf9818e75676d920f
-
SHA256
114f4e62ec2b81ab45799a56b183ef282b2bc5c172fd9831af33c154b23034ea
-
SHA512
de3a276bfd45430cc926a3362246baf78d5de04fecf234549c6ecc219249556aad7fc9e65cadfc83a14edec9940ea1860fbb758376681bbc0bd33b19ce21b724
-
SSDEEP
12288:xdZfTbsC8pAhY42pX13LLA2qpDJzn70NsF/qBth53rSdxj:xfLb78qhIF3LLRkzF/qh536xj
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-