General
-
Target
PO HA25622.exe
-
Size
700KB
-
Sample
240711-hm25tsthmr
-
MD5
6887db1f6c75ae73f95dc1e8b7ba45f0
-
SHA1
a6eae243627dd243dfc1ba7d8ecb0db32d2b04e0
-
SHA256
e1153fa8e128ce45bc1fd82c073aa9724653ae65a621f7accf41a7b4ea542906
-
SHA512
8ce6ac3dd86793027a12f48f451d141d809b0c757177e60aedfef2d8e57ae12f039035f43e45696e059edffe4edf7f10e42a53f1b796f7740f23483399984fad
-
SSDEEP
12288:GVkFuwcbZzHNoW1XMn+oCUufZv7ftOwz3geqeDWSmb6+Sg:hZAZzHNoW1O+oWZv7frzwvTb6+Sg
Static task
static1
Behavioral task
behavioral1
Sample
PO HA25622.exe
Resource
win7-20240705-en
Malware Config
Extracted
formbook
4.1
h209
sbtstuff.site
omlyes.com
movershifting.com
gearballer.com
oketoto.pro
myringleader.com
lrcjc750s.xyz
ata2024.xyz
password-manager-89409.bond
aiassistanthub.net
changvolt.cfd
netino.site
wear-wale.com
omnipresenceagency.com
huangguan.ooo
propersonnelmedia.com
9332952.com
k3s.support
ciytrw.xyz
cb095.pro
royalreshortbooking.xyz
studio29photography.com
62472.xyz
offerseshop.com
xn--mjru74buk5boca.store
jzzkjvaz.com
qzbt7s.com
atsinvest.com
goldengoosemultiplier.com
investing-courses-66663.bond
blueflamenews.com
xn--72cb0bab2pc6b3j3b.com
damtv24.xyz
ya1w.top
margueritemeilleure.com
zinittech.com
testingdomain.xyz
zakenlatyn.xyz
jungdofire.com
jackpfenninger.com
comfyquiltsbysusan.com
weststarconstructions.com
accrevcenglobal.com
ok9km1.fun
cxbqchm.life
review-with-hossain.com
webmedianews.com
visioncaretutor.com
r9x4g.xyz
nicorinehart.com
airhead.icu
genesisproj.online
hebatduta77.com
xiaopangonsol.com
cilynder.com
nestnerd.xyz
95476.photos
wearepartisan.rocks
snowshop4.com
podoc.fun
psicologaceciliabarros.com
klassens.info
therocketlobsters.com
world-palace.com
antibirdnetservices.com
Targets
-
-
Target
PO HA25622.exe
-
Size
700KB
-
MD5
6887db1f6c75ae73f95dc1e8b7ba45f0
-
SHA1
a6eae243627dd243dfc1ba7d8ecb0db32d2b04e0
-
SHA256
e1153fa8e128ce45bc1fd82c073aa9724653ae65a621f7accf41a7b4ea542906
-
SHA512
8ce6ac3dd86793027a12f48f451d141d809b0c757177e60aedfef2d8e57ae12f039035f43e45696e059edffe4edf7f10e42a53f1b796f7740f23483399984fad
-
SSDEEP
12288:GVkFuwcbZzHNoW1XMn+oCUufZv7ftOwz3geqeDWSmb6+Sg:hZAZzHNoW1O+oWZv7frzwvTb6+Sg
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-