General
-
Target
H37012.exe
-
Size
677KB
-
Sample
240718-ggvywszhnd
-
MD5
6c63cd4270013e1d03abde4d6acf18fe
-
SHA1
70a81b1b6d7b773d48e6293d23cb7858d69d4a7b
-
SHA256
94f29a8158717b4c268b41e8eb72bc7301f2d4578dc41a06deabe79ff8e767dd
-
SHA512
e05335e284dc5941fe678f24307ea08d5a5a12ce769cc1be1541cc544f3eac99970f6757e0dd93b687569f165e4bb022965be87fc3041095d718abd9f904d0d8
-
SSDEEP
12288:BJbDWx2PQf9YGtFgiscZBpOf9DtMu461PxlWGsxthsQYG:BFawMZ/g0p0su163HyQYG
Static task
static1
Behavioral task
behavioral1
Sample
H37012.exe
Resource
win7-20240708-en
Malware Config
Extracted
formbook
4.1
h209
sbtstuff.site
omlyes.com
movershifting.com
gearballer.com
oketoto.pro
myringleader.com
lrcjc750s.xyz
ata2024.xyz
password-manager-89409.bond
aiassistanthub.net
changvolt.cfd
netino.site
wear-wale.com
omnipresenceagency.com
huangguan.ooo
propersonnelmedia.com
9332952.com
k3s.support
ciytrw.xyz
cb095.pro
royalreshortbooking.xyz
studio29photography.com
62472.xyz
offerseshop.com
xn--mjru74buk5boca.store
jzzkjvaz.com
qzbt7s.com
atsinvest.com
goldengoosemultiplier.com
investing-courses-66663.bond
blueflamenews.com
xn--72cb0bab2pc6b3j3b.com
damtv24.xyz
ya1w.top
margueritemeilleure.com
zinittech.com
testingdomain.xyz
zakenlatyn.xyz
jungdofire.com
jackpfenninger.com
comfyquiltsbysusan.com
weststarconstructions.com
accrevcenglobal.com
ok9km1.fun
cxbqchm.life
review-with-hossain.com
webmedianews.com
visioncaretutor.com
r9x4g.xyz
nicorinehart.com
airhead.icu
genesisproj.online
hebatduta77.com
xiaopangonsol.com
cilynder.com
nestnerd.xyz
95476.photos
wearepartisan.rocks
snowshop4.com
podoc.fun
psicologaceciliabarros.com
klassens.info
therocketlobsters.com
world-palace.com
antibirdnetservices.com
Targets
-
-
Target
H37012.exe
-
Size
677KB
-
MD5
6c63cd4270013e1d03abde4d6acf18fe
-
SHA1
70a81b1b6d7b773d48e6293d23cb7858d69d4a7b
-
SHA256
94f29a8158717b4c268b41e8eb72bc7301f2d4578dc41a06deabe79ff8e767dd
-
SHA512
e05335e284dc5941fe678f24307ea08d5a5a12ce769cc1be1541cc544f3eac99970f6757e0dd93b687569f165e4bb022965be87fc3041095d718abd9f904d0d8
-
SSDEEP
12288:BJbDWx2PQf9YGtFgiscZBpOf9DtMu461PxlWGsxthsQYG:BFawMZ/g0p0su163HyQYG
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-