General
-
Target
cab40794f5708707881d38e1b5fbc84b053de05638295706e64bc9b1257d96f4
-
Size
610KB
-
Sample
240417-r6xtwsec31
-
MD5
75a5ccc2956857105665aa61f4387199
-
SHA1
06b2c5a7396c6b3e9653922bd2db303373908590
-
SHA256
cab40794f5708707881d38e1b5fbc84b053de05638295706e64bc9b1257d96f4
-
SHA512
a9d05249288a9f797c5208ce1acea765f27c4fd70707687277c44c4b3f9d61757e52fe833c390619c13b6d0139e8ed754a40373dc96d4ed7d8cceb4d027ebf8f
-
SSDEEP
12288:gcL5sxaoZ6ZY0r5baPaoKK99PBS30HxL+78SijwL2I/QAavbTLZzrRrJ:gcL59oZ66gbaPao5Pw3ka7HijpI/MrZT
Static task
static1
Behavioral task
behavioral1
Sample
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe
Resource
win7-20240220-en
Malware Config
Extracted
formbook
4.1
gy14
mavbam.com
theanhedonia.com
budgetnurseries.com
buflitr.com
alqamarhotel.com
2660348.top
123bu6.shop
v72999.com
yzyz841.xyz
247fracing.com
naples.beauty
twinklethrive.com
loscaseros.com
creditspisatylegko.site
sgyy3ej2dgwesb5.com
ufocafe.net
techn9nehollywoodundead.com
truedatalab.com
alterdpxlmarketing.com
harborspringsfire.com
soulheroes.online
tryscriptify.com
collline.com
tulisanemas.com
thelectricandsolar.com
jokergiftcard.buzz
sciencemediainstitute.com
loading-231412.info
ampsportss.com
dianetion.com
169cc.xyz
zezfhys.com
smnyg.com
elenorbet327.com
whatsapp1.autos
0854n5.shop
jxscols.top
camelpmkrf.com
myxtremecleanshq.services
beautyloungebydede.online
artbydianayorktownva.com
functional-yarns.com
accepted6.com
ug19bklo.com
roelofsen.online
batuoe.com
amiciperlacoda.com
883831.com
qieqyt.xyz
vendorato.online
6733633.com
stadtliche-arbeit.info
survivordental.com
mrbmed.com
elbt-ag.com
mtdiyx.xyz
mediayoki.site
zom11.com
biosif.com
aicashu.com
inovarevending.com
8x101n.xyz
ioherstrulybeauty.com
mosaica.online
venitro.com
Targets
-
-
Target
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe
-
Size
638KB
-
MD5
6975f1f27e4016368f71dabba716ca6e
-
SHA1
3225deb13c647b26a52c59a328b3432cff5e8871
-
SHA256
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1
-
SHA512
362c0901c959f12357263254bbbc0105824bdee7da87ca4c1e9ea0f0c7717761a97a0b954ec3150c4e4e74aea0e33a77c1b8a360e344c9395d75e0f108284702
-
SSDEEP
12288:n9d2iNjJz/IIHF3fKqHqWLr66AEWzP0S0iHjl8KqUitqfZqb2V2M31VgCnoe:nn1NJz/IIHFv9HtLW6AEWz/0SitAgmLP
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-