General
-
Target
FTT63730923.exe
-
Size
590KB
-
Sample
231022-jgeb9afh84
-
MD5
e085287e182e1fe1afc6136e08639b49
-
SHA1
5eb95ee31e92596ab20100ad13358c5e214c20cf
-
SHA256
2f717becc408420e2dfdcac5643bcf420ce2a8e3e28320c23b3db7a489235f2a
-
SHA512
0a22ce57d336d07ece3121144c9aa67a5db67164782cf53e60ecd3689e8ba6af6f0d4ed49dbf9b7afdabee4cd24c61d105083104740b02f7beb8ee1927674414
-
SSDEEP
12288:u8zS55mFzhcNurziYbsFTzKyGvmKE8GJnff5VBJSCQ:uf55qF6urz9IFPOuZ5nsJ
Static task
static1
Behavioral task
behavioral1
Sample
FTT63730923.exe
Resource
win7-20231020-en
Malware Config
Extracted
formbook
4.1
cy12
routinelywell.com
traderinformation.com
xv1lz.cfd
elfiensclinic.com
dfwtexasmilitaryagent.com
gb3p8a.com
ofcure.com
kslgd.link
apexassisthubs.com
270hg.com
spacovitta.com
mattress-info-hu-kwu.today
jakestarrbroadcast.com
modestswimwearshop.com
game0814.com
gec.tokyo
growwellnesscoaching.com
thefavoreats.com
gaasmantech.net
mloffers.net
sarahklimekrealty.com
fnykl2.com
nuomingjs.com
thewanderingbarfly.com
affiliatebrokers.cloud
yourdesignneed.com
360expantion.com
burumakansatunikki.com
hh870.bio
com-safe.site
ssongg4134.cfd
juntocrecemosalinstante.top
poorexcuses.com
stargear.top
ktobr.live
s5266m.com
paragon-cto.net
luohuigroup.com
srspicture.com
jounce.space
otrnton.top
jhaganjr.com
eshebrown.com
mc-ibit.com
rundlestreetkenttown.net
ssongg3132.cfd
thedivorcelawyer.website
ipcontrolsas.com
ungravity.dev
vigne.tattoo
modcoops.com
earthbondproperty.com
pachinko-and-slot.tokyo
pp88money.com
mysweettangrine.com
barbieinterviews.com
aimageabove.com
hamidconstruction.com
xcolpuj.xyz
xxxvedio.online
ceracasas.com
mariaelamine.com
eew.lat
pmugly.top
withscreamandsugar.com
Targets
-
-
Target
FTT63730923.exe
-
Size
590KB
-
MD5
e085287e182e1fe1afc6136e08639b49
-
SHA1
5eb95ee31e92596ab20100ad13358c5e214c20cf
-
SHA256
2f717becc408420e2dfdcac5643bcf420ce2a8e3e28320c23b3db7a489235f2a
-
SHA512
0a22ce57d336d07ece3121144c9aa67a5db67164782cf53e60ecd3689e8ba6af6f0d4ed49dbf9b7afdabee4cd24c61d105083104740b02f7beb8ee1927674414
-
SSDEEP
12288:u8zS55mFzhcNurziYbsFTzKyGvmKE8GJnff5VBJSCQ:uf55qF6urz9IFPOuZ5nsJ
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-