General
-
Target
a4de39a318f8fb37cf0ac7f320a6cf7f8b68a403ea26d3c5f8b82630f6693b70.exe
-
Size
645KB
-
Sample
240718-xjyess1hmp
-
MD5
51d304a31d64e8975c2cdfad3367f686
-
SHA1
8cc59a68e3f6f6ada93abfbaeae2b6dc698cd085
-
SHA256
a4de39a318f8fb37cf0ac7f320a6cf7f8b68a403ea26d3c5f8b82630f6693b70
-
SHA512
e6158154334f211333430791dce7d90622b0cd90672607a2e3e1ac075b64c89c9313a0bc82196d6bbc80f036022b670fa35e6d7952d87b3e4566eeda2c0f9d59
-
SSDEEP
12288:b51eKYx6+DaBbWTYoFnXFqdXKr87wgI7gY10ZAYbmOLPbIQdRlF6v/kR:jUo+uBsFBFMXU87QgYWaYbmOLhRv6va
Static task
static1
Behavioral task
behavioral1
Sample
a4de39a318f8fb37cf0ac7f320a6cf7f8b68a403ea26d3c5f8b82630f6693b70.exe
Resource
win7-20240708-en
Malware Config
Extracted
formbook
4.1
dk07
reclam.xyz
parchmentmediaadd.com
gaolibai.site
menage-exclusif.com
ceremoniesbyjade.com
5663876.com
take3.xyz
environmentaladvocacygroup.com
fp38z.rest
elektro-vlasic.com
bollybytestv.com
udfunsd.cloud
studiomiraiarq.com
e-commercebrasil.shop
sansiddhiedu.com
draaronroughan.net
24angel.com
rjh-equestrian.com
22db3rgdg6a73pea7.vip
mintygreen-wellnessportal.com
dewakipas88.art
fauteam.top
elyridia.com
msmotorsjp.com
arm-uk.com
wukunstudio.com
96503862.com
ygsj009.xyz
tbstli119w.top
correctionia.com
howdowear.com
760sun.com
1win-yyy-official7.xyz
colmeiaofertasloja.com
megadealsonline.shop
mumuvpn.life
vialglass.website
charliebearventures.com
lynxpire.com
labnicear.shop
thrillhouse.fail
biamane.com
celestialcharts.network
bt365231.com
247866.top
dungcamvu.com
floraperfumaria.com
connectedword.site
pamanwin.com
jbovietnam.vin
tanomi.dev
globalsupdate.xyz
santandecentral.com
xewaov.xyz
384058.com
kindya.xyz
pan-ason19.com
getpurvivee.online
17tk555j.com
fullmoondating.com
mu-vietco.com
cohailpros.com
8uh85t.xyz
slotcuan88login.com
nonewaveneb.live
Targets
-
-
Target
a4de39a318f8fb37cf0ac7f320a6cf7f8b68a403ea26d3c5f8b82630f6693b70.exe
-
Size
645KB
-
MD5
51d304a31d64e8975c2cdfad3367f686
-
SHA1
8cc59a68e3f6f6ada93abfbaeae2b6dc698cd085
-
SHA256
a4de39a318f8fb37cf0ac7f320a6cf7f8b68a403ea26d3c5f8b82630f6693b70
-
SHA512
e6158154334f211333430791dce7d90622b0cd90672607a2e3e1ac075b64c89c9313a0bc82196d6bbc80f036022b670fa35e6d7952d87b3e4566eeda2c0f9d59
-
SSDEEP
12288:b51eKYx6+DaBbWTYoFnXFqdXKr87wgI7gY10ZAYbmOLPbIQdRlF6v/kR:jUo+uBsFBFMXU87QgYWaYbmOLhRv6va
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-