General
-
Target
DHL OVER DUE ACCOUNT NOTICE.r01
-
Size
578KB
-
Sample
240327-tzjd2afh99
-
MD5
2bda7085f76223525f356ca7694ed982
-
SHA1
8e18b989424a56577001438c2322ea77ae3cd1e9
-
SHA256
bd72f09ed9f35ab1327aef7ca8f0fc9ed6f696a0ec120e5ab4eca3ca32fa74b9
-
SHA512
1693a2830f863ada0acc0c6522e284af3bfea2b41a7338ccbe0bf819d9d60ae418a94e54b60afb47489fa0f34bf9462f65862e343c0ff43072707b0f565c04bd
-
SSDEEP
12288:CCdWKUN7QTBUUsd0/AFlf0ydtE+mIemWYkJ/2O/10:TWHeBUUXwJPA//0
Static task
static1
Behavioral task
behavioral1
Sample
4UWmsYiIC0tdIFk.exe
Resource
win7-20240221-en
Malware Config
Extracted
formbook
4.1
ns03
dipity.tech
agathis.fun
ekaterinai.store
elizabethsbookshelf.com
smilesustainably.com
tapeworm.xyz
beatricesswarthout.xyz
nsrpackersandpackers.in
yedxec.xyz
gildedbeautyaesthitics.com
hanibalbechar.com
fichaphuman.net
adilosk.shop
geezaran.com
ventasemail.com
phonecasesdirect.store
rctjuc.shop
sukimossmanagement.com
caller-id.today
kft07.vip
mahbubamaahi.com
tcindustrie.net
ng-stl.com
vb4n53g4fh354gf5jh.top
repair-services.today
fonbnk.pro
olivabelle.com
pqeomjr.cc
elevatedblanks.net
ambiatec.solutions
quantumaster.online
pocket-option.tech
circly.net
focus2c.com
armacao-de-oculos.com
bmcj365.com
maxhealthunity.com
taifengtechnologyservice.com
zerolethal.com
dramaqu.guru
kukrejaassociates.in
jamesjenner.com
signature-perfect.com
fbaparadise.com
yandada.us
rcpbooks.site
celonstore.fun
dailynewarker.com
594545.xyz
chuanruhaomen.com
planetpost.lol
kinovod130424.pro
lavanced.com
leclandesparents.com
childnchestcare.com
taiyuanbaoyang.com
engagenotrage.com
halffullliving.com
scheuermannworks.com
oengpalworld.store
derech-hamagah.com
clintomator.com
velvetgloveseasonings.store
pkclubc.site
grupooceanique.com
Targets
-
-
Target
4UWmsYiIC0tdIFk.exe
-
Size
639KB
-
MD5
c53f831c0cfef4921d4236c6435a0481
-
SHA1
961318099fa7615e9cf70cd87508df982cb13d97
-
SHA256
4c60c35f29e69092f5e26e18d43f332f00f33be5006dfb0f9e8cc7327ec6db92
-
SHA512
c4b45588aa914d3f11c1c9b5225bf9f47fb41dc06cc6572fc9e7666d74b60d4b9a0160c1f46fbd9841ce493b6ed1e8a864ae4459da9397ac8d2908dc98c20fbf
-
SSDEEP
12288:10KoFwl0ECedQwZTAO8zfkWdebsqC5oAawLOfk5ukR:+KoU0ECepZcOl9sqCZabfs
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-