General
-
Target
uzomazx.exe
-
Size
1.0MB
-
Sample
230827-ltx18sgh42
-
MD5
c178cb400a5d151c4e59640ca55b604a
-
SHA1
2f335f8791e3effef43c8f3441d9573f70ea22e9
-
SHA256
903bfcbe2d85143ad723b47ed1edc96f5416fa3b584fe76e74d75e93ff4b2e64
-
SHA512
fcc86d5858403f0a93ce1bda799e88338ad758403c1c6124ac181d61725052e0e1bd99edf1beff341cb576d085b63d3b78966c56a8b79cdf56b8d60a28e28527
-
SSDEEP
24576:j1u6u4RbJDAzdUqYyDim6cF56gemFZiPZHWxEGPnqdOp:jV9RbJwdtim6cF5sR2xEGPnqdO
Static task
static1
Behavioral task
behavioral1
Sample
uzomazx.exe
Resource
win7-20230712-en
Malware Config
Extracted
formbook
4.1
ua69
uslanmayizz.com
rrucrowd.com
nerexy.online
guolang-clan.com
meteleabogados.com
sh-gottipati.com
themesmiui.com
anananlan.com
roghanala.com
yekitiba.com
echoskinco.com
btlpour.xyz
shoyo-samaa.com
fuzzywumpus.net
malerzeit.com
xiam.online
brandibraunalissa.com
cryptominis.pro
we-living.com
dc-invest.online
bai8snn.top
angel-barroso.com
findingxanadu.life
overlayapiprovider.com
daniellemarietromp.com
zhumengtv.com
sckhkj.xyz
shangpu55.com
kimbellmedia.com
arperkonline.com
latinjock.com
skyeye.top
27server.space
stanwoodhairsalon.com
jlgeospatial.com
dimetodozen.com
adneinter.com
tinylotsrus.com
cinziabellydance.com
dg-zu.com
ghsng.com
migrant.productions
ozelinciegitim.com
tyc88128.com
beachbabebraids.com
neomcontacts.com
hernandocountylocksmith.com
riellalayneco.com
anjipooh.com
kururia.fun
interviewapplication.net
whynotmellc.com
pinellasgov.com
duckdollars.com
bas-project.website
alws.top
dangdangfanli.com
verdemoosa.com
drlovebhatia.com
betpara258.com
fmbzaw.top
pasionxfutbol.com
webers.site
lorgp.com
tactica.studio
Targets
-
-
Target
uzomazx.exe
-
Size
1.0MB
-
MD5
c178cb400a5d151c4e59640ca55b604a
-
SHA1
2f335f8791e3effef43c8f3441d9573f70ea22e9
-
SHA256
903bfcbe2d85143ad723b47ed1edc96f5416fa3b584fe76e74d75e93ff4b2e64
-
SHA512
fcc86d5858403f0a93ce1bda799e88338ad758403c1c6124ac181d61725052e0e1bd99edf1beff341cb576d085b63d3b78966c56a8b79cdf56b8d60a28e28527
-
SSDEEP
24576:j1u6u4RbJDAzdUqYyDim6cF56gemFZiPZHWxEGPnqdOp:jV9RbJwdtim6cF5sR2xEGPnqdO
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-