General
-
Target
MalwareBazaar.9
-
Size
30KB
-
Sample
240711-j3ym1sxdln
-
MD5
c2096d577649db24d8c95e5be371df90
-
SHA1
47effda8605c8744122a415a8146242ba1ad99c3
-
SHA256
d3dc12d67ef09ff3755e0f4062a85342e35502dff88561eef11d933a07a12f8b
-
SHA512
c0adff2dd075f363ca339fc8cfb0ac910104573b04c113742b3620da19bc56939022ae0dc33adb23e986f4e85cb5167797c2b86c6c995ed0fa230b1b574e1fc4
-
SSDEEP
384:1zMKK76JtZH/E1IAvx22m1x61yr2tnk+N4qTpZqFch:1zMKHJtZYIAvox1xqyr0k+6qtlh
Static task
static1
Behavioral task
behavioral1
Sample
MalwareBazaar.vbs
Resource
win7-20240705-en
Malware Config
Extracted
formbook
4.1
ss24
agingwellhc.com
unikbetanggur.autos
eb2024yl.top
ja380.xyz
thehalcyon.studio
maudsoogrim.com
esteler10.click
mewtcp.xyz
www-zjbf1.club
kucinglucu.online
lunwencheck.com
65597.photos
erbxeu358h.top
startable.online
yousend.xyz
csharksg.com
centricoatings.com
ntruhslearn.xyz
achabakra.xyz
zuntool.com
jejbtl738a.top
runebinder.com
fidogmesvies170s63.online
online-unicsedritcorp.com
8208975.com
supporthq.life
protocolozeroacne.com
ocotilloco.com
xcolbu456t.xyz
ciclidossi.com
163875.shop
strangebedfellowstheatre.com
unikbetjeruk.homes
jhlktwyq.xyz
realearthpower.com
crucka.xyz
pkvnvtdb.com
profitablecasino.com
uspspsnami.top
thejerkspices.com
sivagiriashram.info
usavisa8loan.xyz
deoconverter.pro
investing-courses-66663.bond
2025tengxun171.lat
bluebirdbodyworkstudio.com
siblingstalk.com
lxcqx.com
amharicprofessional.pro
lijiangstory.net
barflybook.com
eldesigin.com
yd81w.top
head2toe.boutique
varun.works
next-genlion.com
awvd97.com
derindenizotel.com
vertibridge.xyz
qdfake609am.xyz
acc-pay.top
qblackbit.com
pallesudatissime.com
8548d.com
ygyqpswy.xyz
Targets
-
-
Target
MalwareBazaar.9
-
Size
30KB
-
MD5
c2096d577649db24d8c95e5be371df90
-
SHA1
47effda8605c8744122a415a8146242ba1ad99c3
-
SHA256
d3dc12d67ef09ff3755e0f4062a85342e35502dff88561eef11d933a07a12f8b
-
SHA512
c0adff2dd075f363ca339fc8cfb0ac910104573b04c113742b3620da19bc56939022ae0dc33adb23e986f4e85cb5167797c2b86c6c995ed0fa230b1b574e1fc4
-
SSDEEP
384:1zMKK76JtZH/E1IAvx22m1x61yr2tnk+N4qTpZqFch:1zMKHJtZYIAvox1xqyr0k+6qtlh
-
Formbook payload
-
Adds policy Run key to start application
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-