General
- Target TS-240405-UF4.exe
- Size 564KB
- Sample240405-nql6nsbc55
- SHA256 ff992922faba92aaae30e5f2b9e4179209fe9242a90da90fe082f50e93138fc7
- MD5 bb06eb677519835edfc19bc1f1c3f126
- SHA1 0652e8726f35b2c4e55766c02d7f24ec93ab5aaa
- SHA512 a1c2ba8d210338833efdefa0b76e928983cb8adda7fafc96ed8b77f4187b0e64ea1f176329124866497330912cdda571c2bcb3db4414659853ceec2168680419
- SSDEEP 12288:F7UHpfiPSv/0NHJ/ZmKlbreGzOPnvAVihoKgzvpG6FYkR:+HRmS6x/16G6PnvA4ho1zB/FP
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
TS-240405-UF4.exe
Resource
win7-20240221-en
Malware Config
Extracted
-
formbook
-
4.1
-
be03
-
458q14v4ams2.com
-
priceoctopus.com
-
betinplay.xyz
-
bcnd.xyz
-
1510soliveavenue.com
-
mcdpropertypros.com
-
reddcrownexpress.com
-
rewardlabs.shop
-
burenbrand.com
-
revand.io
-
tractionendurancecoaching.com
-
jotaerreshopp.com
-
shopboyg.com
-
dakor.shop
-
groundswellmag.life
-
nehagadodia.com
-
dancarellibizbroker.com
-
meconline.co
-
ttmq.cc
-
thegoldenyouph.com
-
poolcenter.store
-
portalesexpress.com
-
okltyf.xyz
-
wnkj001.site
-
wltk.site
-
nexosmedic.com
-
cartell.app
-
yteam.tech
-
gpt-toolbox.io
-
plexirecruiters.com
-
beerattraction.com
-
11111bet365.com
-
24laura.info
-
stupididiotmoron.com
-
test-igot.com
-
gramotnosti.store
-
truck-driver-jobs-2024.online
-
fundedxprop.com
-
xpendly.cc
-
mobtruecrime.com
-
3051harborview.com
-
6891ybfh.xyz
-
growthpfad.com
-
sygtrainings.com
-
fastgrowthleads.com
-
kiwiceleste.store
-
fidesinvicta.com
-
oneupmushroom.store
-
socialsellingbootcamp.com
-
dy-gmvrp.xyz
-
d3cargo.com
-
6ixsoft.com
-
fengyuncq.com
-
stmerry888.com
-
yahliker.online
-
numoneypro.com
-
jadediver.com
-
lauvhoney.com
-
oirdesign.com
-
robobussy.com
-
healthstartsinyour20s.com
-
roofing-jobs4-in-205nz.today
-
alexisfennillustration.com
-
abandoned-houses-se-0.bond
-
j88.kids
Targets
-
- Target TS-240405-UF4.exe
- Size 564KB
- SHA256 ff992922faba92aaae30e5f2b9e4179209fe9242a90da90fe082f50e93138fc7
- MD5 bb06eb677519835edfc19bc1f1c3f126
- SHA1 0652e8726f35b2c4e55766c02d7f24ec93ab5aaa
- SHA512 a1c2ba8d210338833efdefa0b76e928983cb8adda7fafc96ed8b77f4187b0e64ea1f176329124866497330912cdda571c2bcb3db4414659853ceec2168680419
- SSDEEP 12288:F7UHpfiPSv/0NHJ/ZmKlbreGzOPnvAVihoKgzvpG6FYkR:+HRmS6x/16G6PnvA4ho1zB/FP
- MD5 SHA1 SHA512 SSDEEP
Formbook payload
Deletes itself
Suspicious use of SetThreadContext