General
-
Target
Znuvgbtsedoszb.exe
-
Size
2.8MB
-
Sample
231203-ty9vlach78
-
MD5
d726d57563144b62b4688cc12e34cfda
-
SHA1
5ce5d9e655a8bc6bec4c5b823f1a2ad6bfeff327
-
SHA256
83320be7f5851145e2f8713daeea3bcf5eff2ac87d63e6e47336f95ed22e91c8
-
SHA512
010712d263144ae1cfd5a907ad66768fd8cf5b6654f80d8c8de7e136b73184a957000f3e022d473a49fb3432717068254fbb57a115eb803aad95b9d4288c6122
-
SSDEEP
49152:Xm/PpH8yc0/wU2lpe63ZrxKrVEbRIqiPt411Fehg1mQzZ:XOpcyV/wjpdZrxEVEtI14xqnY
Static task
static1
Behavioral task
behavioral1
Sample
Znuvgbtsedoszb.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Znuvgbtsedoszb.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
formbook
4.1
fadc
protechdream.com
faireco.life
bakrinhome.com
bustygirl.xyz
kbif.info
ningo.bond
hollywoodcircleevents.site
eapv-uabjo.com
852bets.com
nooption.online
global-strategy.pro
cartaonline.online
sacredbones2023.com
barsandbands.fun
liftchairs-info-mx.today
delamar.one
shuntianyuan.net
americanworldsolutions.com
julitv.net
criativax.com
edge-estimates.info
fursanalhamayel.com
huilingtong.net
cheemanotary.com
myartgallery.net
mrsearthphilippines.com
auth7070-50.cfd
wrld.site
mypluscoins.com
curvepro.net
petticoatsandpockets.com
dzji12.top
y250rx08ow.top
korearx.com
sensorlightsales.com
kloveloboosting.com
innercircleloans.com
r0g.lat
hombresprostatabio.online
telcosme.com
ansorullawfirm.com
donateprolifeministry.com
wtmidsole.com
tincoco.net
yuanlaigou.net
complete-s.monster
dm16888.xyz
aidadesignhub.com
lcyj.net
qiohdf55123.com
arlnx.com
haixindx.com
2viaequatorial.com
biaogewuliu.com
kristieannmarkets.com
iptvtest.live
vanheltenadviesenfinance.com
seathee.com
ywhlearn.com
eeee84.com
tr-dysonbayisi-tr.com
annaddiddi.com
kmdsz.net
ocseawatch.com
baoshengmaritime.com
Targets
-
-
Target
Znuvgbtsedoszb.exe
-
Size
2.8MB
-
MD5
d726d57563144b62b4688cc12e34cfda
-
SHA1
5ce5d9e655a8bc6bec4c5b823f1a2ad6bfeff327
-
SHA256
83320be7f5851145e2f8713daeea3bcf5eff2ac87d63e6e47336f95ed22e91c8
-
SHA512
010712d263144ae1cfd5a907ad66768fd8cf5b6654f80d8c8de7e136b73184a957000f3e022d473a49fb3432717068254fbb57a115eb803aad95b9d4288c6122
-
SSDEEP
49152:Xm/PpH8yc0/wU2lpe63ZrxKrVEbRIqiPt411Fehg1mQzZ:XOpcyV/wjpdZrxEVEtI14xqnY
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload
-
ModiLoader Second Stage
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-