hxxps://l[.]facebook[.]com/l[.]php?u=https%3A%2F%2Fswiy[.]co%2FMCs8%3Fu%3Dhttps%253A%252F%252Fapp[.]alibaba[.]com%252Fdynamiclink%253Fmedium_source%253Dfacebook%2526traffic_type%253Dinstall%2526field%253DUG%2526schema%253Denalibaba%25253A%25252F%25252FoneSight%25253Fbiz%25253Ddpa%252526keyword%25253DCricket%252526product_id%25253D10000002872855%252526pcate%25253D202017804%252526from%25253Dcpm_fb%252526kpi%25253Dabrate%252526tagId%25253D10000002872855%252526categoryId%25253D202017804%252526categoryName%25253DCricket%252526traffic_type%25253Dinstall%252526field%25253DUG%2526fbclid%253DIwAR0FLnSeScwkIjojGGpbgrP8Nb8rCjOxC_Bw_9e4HNK9YZUQ-mmn4qNfTcg%26h%3DAT2sib1bjmYXmw0YZ7em-OROLzWKd3Cwg1n4p716uPjxfW28kE1xSaJOhB1Ki5L0jpTi9EoEFVqUTsDfbrHDqnTg1TsTQFZDFzoCEH-46GQgXIOoZ6Wno_wFX65Fw_pMqWD_v5sAr43_rtlgkvuqKQ%26medium_source%3Dfacebook%26channel_url%3Dhttps%253A%252F%252Fstaticxx[.]-[.]com%252Fconnect%252Fxd_arbiter%252Fr%252F__Bz3h5RzMx[.]js%253Fversion%253D43%2523cb%253Df2c4458ac9011a8%2526domain%253Dwww[.]-[.]com%2526origin%253Dhttps%25253A%25252F%25252Fwww[.]faceapp[.]com%25252Ff9e05c506536d8%2526relation%253Dopener%26display%3Dpopup%26e2e%3D%257B%257D%26fallback_redirect_uri%3Dhttps%253A%252F%252Fwww[.]-[.]com%252Frecording%252Fanne-marie-2002%252F769467295_2588586667%26href%3D__xts__0%253D68[.]ARA_fKMo3PCf_itDVcXQhmoHtVpYrYJyDDs76y2dhfAsoU-58W9VS05DfwdiyHb-wOvGUvyctO00vhLED47VtVNb_vYcPCbYnhZCaL1Lwa2IHimHvSLtip8S8Jf7CJeijc8kHFZJWgOqAFKbVGzFiSdm5NLOBRLnjCcIwezvzH9cKKFDhwnUmp8U_VRDFy55LQhsAK9CV4oXqrNNMndbYTWxI7qzwY9pVp0uHU8dqdtXCiS9h7dcnW7ypQzvhGFSQhgbJomGSUNvSnLLt1jmrEXY1CHcFk1lreKv_YYNTDPgwKJnHJb9uGrUbVUi-17V2--IxFxf3ZPksX9yAtKJlfYX5UYXAug9JVu8cRrwPBXq2KYsvrz0%26__tn__%3D-R%253Futm_medium%253Dweb%2526utm_campaign%253Dshare%2526utm_medium%253Dfacebook%26locale%3Den_US%26mobile_iframe%3Dfalse%26next%3Dhttps%253A%252F%252Fstaticxx[.]-[.]com%252Fconnect%252Fxd_arbiter%252Fr%252F__Bz3h5RzMx[.]js%253Fversion%253D43%2523cb%253Dfbf82db659b47c%2526domain%253Dwww[.]-[.]com%2526origin%253Dhttps%25253A%25252F%25252Fwww[.]-[.]com%25252Ff9e05c506536d8%2526relation%253Dopener%2526frame%253Df12a89dbefb1ca%2526result%253D%252522xxRESULTTOKENxx%252522%26sdk%3Djoey%26version%3Dv18[.]9%26fbclid%3DIwZXh0bgNhZW0CMTEAAR31An5tsB0Aq3J2gpg6HyeOM8qxDkvqvi9gxoBdwz1K9lwY4X5KLtgivNY_aem_AVdjJ79L4wUYQlNAM0Cgh18_zVZ0oJ-GPhnK3HwNILEIEYIAp-AFaurjW-TYeSBu1r7dy1TFR_4iW4BZtr1ivuxl&h=AT3jhBLYObpAbqkXj2gmM9UePFpBEOrDcug36tqgIrFowQ8c_wJZayXKUQ2hdDvO1KMbInbeITxf9uMvIrgHU8FjOPOzQnlEb6C7lJEIGdgAJfJ0wUHLnlkpIEOh5CdPA8dB7qq-cg&__tn__=H-R&c0=AT3dsRkcLNDtYBHLqRxnS5OBbht1Y-4ffQF--4V1BYqUkEgDz8mTISQA_AECiZ6Pi-Yz6wwqFq2YDnlRPfgoT61HmdzpW3W7b9eizNA3IrLRZm9u1j0_xKXa3dvnG6_HnmG6NDDWOXjmp6QCiPvMpJjlCmvzB0Rqxki_GLdCGl0LpOpYdv1cNNbkiQ

Sharing

Behavioral task

behavioral1

Sample

https://l.facebook.com/l.php?u=https%3A%2F%2Fswiy.co%2FMCs8%3Fu%3Dhttps%253A%252F%252Fapp.alibaba.com%252Fdynamiclink%253Fmedium_source%253Dfacebook%2526traffic_type%253Dinstall%2526field%253DUG%2526schema%253Denalibaba%25253A%25252F%25252FoneSight%25253Fbiz%25253Ddpa%252526keyword%25253DCricket%252526product_id%25253D10000002872855%252526pcate%25253D202017804%252526from%25253Dcpm_fb%252526kpi%25253Dabrate%252526tagId%25253D10000002872855%252526categoryId%25253D202017804%252526categoryName%25253DCricket%252526traffic_type%25253Dinstall%252526field%25253DUG%2526fbclid%253DIwAR0FLnSeScwkIjojGGpbgrP8Nb8rCjOxC_Bw_9e4HNK9YZUQ-mmn4qNfTcg%26h%3DAT2sib1bjmYXmw0YZ7em-OROLzWKd3Cwg1n4p716uPjxfW28kE1xSaJOhB1Ki5L0jpTi9EoEFVqUTsDfbrHDqnTg1TsTQFZDFzoCEH-46GQgXIOoZ6Wno_wFX65Fw_pMqWD_v5sAr43_rtlgkvuqKQ%26medium_source%3Dfacebook%26channel_url%3Dhttps%253A%252F%252Fstaticxx.-.com%252Fconnect%252Fxd_arbiter%252Fr%252F__Bz3h5RzMx.js%253Fversion%253D43%2523cb%253Df2c4458ac9011a8%2526domain%253Dwww.-.com%2526origin%253Dhttps%25253A%25252F%25252Fwww.faceapp.com%25252Ff9e05c506536d8%2526relation%253Dopener%26display%3Dpopup%26e2e%3D%257B%257D%26fallback_redirect_uri%3Dhttps%253A%252F%252Fwww.-.com%252Frecording%252Fanne-marie-2002%252F769467295_2588586667%26href%3D__xts__0%253D68.ARA_fKMo3PCf_itDVcXQhmoHtVpYrYJyDDs76y2dhfAsoU-58W9VS05DfwdiyHb-wOvGUvyctO00vhLED47VtVNb_vYcPCbYnhZCaL1Lwa2IHimHvSLtip8S8Jf7CJeijc8kHFZJWgOqAFKbVGzFiSdm5NLOBRLnjCcIwezvzH9cKKFDhwnUmp8U_VRDFy55LQhsAK9CV4oXqrNNMndbYTWxI7qzwY9pVp0uHU8dqdtXCiS9h7dcnW7ypQzvhGFSQhgbJomGSUNvSnLLt1jmrEXY1CHcFk1lreKv_YYNTDPgwKJnHJb9uGrUbVUi-17V2--IxFxf3ZPksX9yAtKJlfYX5UYXAug9JVu8cRrwPBXq2KYsvrz0%26__tn__%3D-R%253Futm_medium%253Dweb%2526utm_campaign%253Dshare%2526utm_medium%253Dfacebook%26locale%3Den_US%26mobile_iframe%3Dfalse%26next%3Dhttps%253A%252F%252Fstaticxx.-.com%252Fconnect%252Fxd_arbiter%252Fr%252F__Bz3h5RzMx.js%253Fversion%253D43%2523cb%253Dfbf82db659b47c%2526domain%253Dwww.-.com%2526origin%253Dhttps%25253A%25252F%25252Fwww.-.com%25252Ff9e05c506536d8%2526relation%253Dopener%2526frame%253Df12a89dbefb1ca%2526result%253D%252522xxRESULTTOKENxx%252522%26sdk%3Djoey%26version%3Dv18.9%26fbclid%3DIwZXh0bgNhZW0CMTEAAR31An5tsB0Aq3J2gpg6HyeOM8qxDkvqvi9gxoBdwz1K9lwY4X5KLtgivNY_aem_AVdjJ79L4wUYQlNAM0Cgh18_zVZ0oJ-GPhnK3HwNILEIEYIAp-AFaurjW-TYeSBu1r7dy1TFR_4iW4BZtr1ivuxl&h=AT3jhBLYObpAbqkXj2gmM9UePFpBEOrDcug36tqgIrFowQ8c_wJZayXKUQ2hdDvO1KMbInbeITxf9uMvIrgHU8FjOPOzQnlEb6C7lJEIGdgAJfJ0wUHLnlkpIEOh5CdPA8dB7qq-cg&__tn__=H-R&c0=AT3dsRkcLNDtYBHLqRxnS5OBbht1Y-4ffQF--4V1BYqUkEgDz8mTISQA_AECiZ6Pi-Yz6wwqFq2YDnlRPfgoT61HmdzpW3W7b9eizNA3IrLRZm9u1j0_xKXa3dvnG6_HnmG6NDDWOXjmp6QCiPvMpJjlCmvzB0Rqxki_GLdCGl0LpOpYdv1cNNbkiQ

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

General

Target

https://l.facebook.com/l.php?u=https%3A%2F%2Fswiy.co%2FMCs8%3Fu%3Dhttps%253A%252F%252Fapp.alibaba.com%252Fdynamiclink%253Fmedium_source%253Dfacebook%2526traffic_type%253Dinstall%2526field%253DUG%2526schema%253Denalibaba%25253A%25252F%25252FoneSight%25253Fbiz%25253Ddpa%252526keyword%25253DCricket%252526product_id%25253D10000002872855%252526pcate%25253D202017804%252526from%25253Dcpm_fb%252526kpi%25253Dabrate%252526tagId%25253D10000002872855%252526categoryId%25253D202017804%252526categoryName%25253DCricket%252526traffic_type%25253Dinstall%252526field%25253DUG%2526fbclid%253DIwAR0FLnSeScwkIjojGGpbgrP8Nb8rCjOxC_Bw_9e4HNK9YZUQ-mmn4qNfTcg%26h%3DAT2sib1bjmYXmw0YZ7em-OROLzWKd3Cwg1n4p716uPjxfW28kE1xSaJOhB1Ki5L0jpTi9EoEFVqUTsDfbrHDqnTg1TsTQFZDFzoCEH-46GQgXIOoZ6Wno_wFX65Fw_pMqWD_v5sAr43_rtlgkvuqKQ%26medium_source%3Dfacebook%26channel_url%3Dhttps%253A%252F%252Fstaticxx.-.com%252Fconnect%252Fxd_arbiter%252Fr%252F__Bz3h5RzMx.js%253Fversion%253D43%2523cb%253Df2c4458ac9011a8%2526domain%253Dwww.-.com%2526origin%253Dhttps%25253A%25252F%25252Fwww.faceapp.com%25252Ff9e05c506536d8%2526relation%253Dopener%26display%3Dpopup%26e2e%3D%257B%257D%26fallback_redirect_uri%3Dhttps%253A%252F%252Fwww.-.com%252Frecording%252Fanne-marie-2002%252F769467295_2588586667%26href%3D__xts__0%253D68.ARA_fKMo3PCf_itDVcXQhmoHtVpYrYJyDDs76y2dhfAsoU-58W9VS05DfwdiyHb-wOvGUvyctO00vhLED47VtVNb_vYcPCbYnhZCaL1Lwa2IHimHvSLtip8S8Jf7CJeijc8kHFZJWgOqAFKbVGzFiSdm5NLOBRLnjCcIwezvzH9cKKFDhwnUmp8U_VRDFy55LQhsAK9CV4oXqrNNMndbYTWxI7qzwY9pVp0uHU8dqdtXCiS9h7dcnW7ypQzvhGFSQhgbJomGSUNvSnLLt1jmrEXY1CHcFk1lreKv_YYNTDPgwKJnHJb9uGrUbVUi-17V2--IxFxf3ZPksX9yAtKJlfYX5UYXAug9JVu8cRrwPBXq2KYsvrz0%26__tn__%3D-R%253Futm_medium%253Dweb%2526utm_campaign%253Dshare%2526utm_medium%253Dfacebook%26locale%3Den_US%26mobile_iframe%3Dfalse%26next%3Dhttps%253A%252F%252Fstaticxx.-.com%252Fconnect%252Fxd_arbiter%252Fr%252F__Bz3h5RzMx.js%253Fversion%253D43%2523cb%253Dfbf82db659b47c%2526domain%253Dwww.-.com%2526origin%253Dhttps%25253A%25252F%25252Fwww.-.com%25252Ff9e05c506536d8%2526relation%253Dopener%2526frame%253Df12a89dbefb1ca%2526result%253D%252522xxRESULTTOKENxx%252522%26sdk%3Djoey%26version%3Dv18.9%26fbclid%3DIwZXh0bgNhZW0CMTEAAR31An5tsB0Aq3J2gpg6HyeOM8qxDkvqvi9gxoBdwz1K9lwY4X5KLtgivNY_aem_AVdjJ79L4wUYQlNAM0Cgh18_zVZ0oJ-GPhnK3HwNILEIEYIAp-AFaurjW-TYeSBu1r7dy1TFR_4iW4BZtr1ivuxl&h=AT3jhBLYObpAbqkXj2gmM9UePFpBEOrDcug36tqgIrFowQ8c_wJZayXKUQ2hdDvO1KMbInbeITxf9uMvIrgHU8FjOPOzQnlEb6C7lJEIGdgAJfJ0wUHLnlkpIEOh5CdPA8dB7qq-cg&__tn__=H-R&c0=AT3dsRkcLNDtYBHLqRxnS5OBbht1Y-4ffQF--4V1BYqUkEgDz8mTISQA_AECiZ6Pi-Yz6wwqFq2YDnlRPfgoT61HmdzpW3W7b9eizNA3IrLRZm9u1j0_xKXa3dvnG6_HnmG6NDDWOXjmp6QCiPvMpJjlCmvzB0Rqxki_GLdCGl0LpOpYdv1cNNbkiQ

Sharing

General

Malware Config

Signatures

Files