General
-
Target
690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719.exe
-
Size
601KB
-
Sample
240501-bzag1sch3w
-
MD5
81e2def0b86117a5399a0b11bb4837dd
-
SHA1
c9ee314a02e1d0b19171b7c5a10bf3afff67b35f
-
SHA256
690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719
-
SHA512
1d2e3a87cea3b5421281ef5d9eed818da158c65827c28243cdb115d451cd48aa41a213dac4a51a52c05d0b1f2d5a4702e67366155376e5361e569ee53cc6ebad
-
SSDEEP
12288:iiTB778QCQQ8O0FbtvspPnxn65aYeOUVNK9WDhOA9N54N02+4V29MjX:9B8QDzFIPnSlcK9WDhOMSabmj
Static task
static1
Behavioral task
behavioral1
Sample
690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719.exe
Resource
win7-20240215-en
Malware Config
Extracted
formbook
4.1
mx21
mexiwow.com
oneightycreative.com
ask2fairplay.com
innovativeindustires.com
orderhypnosis.com
qualitycriticalcare.com
scalestarloop.com
francostamales.com
immortalgameclothing.com
kccapcc.com
pauruiz.cat
eddyindyman.com
yourarchivedfashion.com
plantpoweredpodiatrist.com
silvekoski.net
ketoapuwarabson.cloud
themooncartomanzia.com
ikjd7v.cc
listmyhousefast.com
owl3.net
dxyexesj.website
miverton.shop
sagaelectronics.com
hazelgt.com
pamagxenterprises.in
tehinaki.com
goodoneclothing.com
biologenderma.com
eccentric.digital
tunivers.com
successmedspamarketing.com
greekproducts.boutique
work-from-home-30978.bond
theelysianway.com
washing-machine-11040.bond
laser-skin-treatment-51709.bond
ladoli.shop
pillarpilot.com
rocketgroup.media
qweek.art
xczas.xyz
toponlinecasinodeutsch.cc
monetsgarten.com
marketingoias.com
ds99771.com
fonquvw689.xyz
ky595043.cc
gpbworld.com
thehouseofprecise.com
loquacious.top
01fdh.us
abrilbienestarintegral.com
hkcourierservices.com
dreamyessencesco.com
they-like.sbs
sgjxgs.com
ideas-now.com
chulavestidos.com
liyikaisuo.com
jackmax.top
jl888999.com
dgmaharajanews.in
therollermaker.com
horizoncuisine.com
boff.finance
Targets
-
-
Target
690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719.exe
-
Size
601KB
-
MD5
81e2def0b86117a5399a0b11bb4837dd
-
SHA1
c9ee314a02e1d0b19171b7c5a10bf3afff67b35f
-
SHA256
690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719
-
SHA512
1d2e3a87cea3b5421281ef5d9eed818da158c65827c28243cdb115d451cd48aa41a213dac4a51a52c05d0b1f2d5a4702e67366155376e5361e569ee53cc6ebad
-
SSDEEP
12288:iiTB778QCQQ8O0FbtvspPnxn65aYeOUVNK9WDhOA9N54N02+4V29MjX:9B8QDzFIPnSlcK9WDhOMSabmj
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-