General
-
Target
PAID CA2686+CA2687+CA2688.exe
-
Size
1.1MB
-
Sample
241028-qdt2vsxnhj
-
MD5
a4b51a4a802bbd22c815f978f47ea06f
-
SHA1
a8735f152d4e1e21d2ed3095821b909b022a4201
-
SHA256
069a4c2c42050c9037f6a11f9083b312c8bc3159fbe2b73f1e84760da762e6a8
-
SHA512
2733cd65bb29eaedf08dc0a9a4e577e01b4198240edc1c461e9efe78145071970c5116849f7a37d6a7470ed0c7b82ce6b40ed9df7c1aa011406ba2f158f405d8
-
SSDEEP
24576:WfmMv6Ckr7Mny5Qt4BoW8YCj0cdbtMQ6gLgj:W3v+7/5Qt4BoW8O+jgj
Static task
static1
Behavioral task
behavioral1
Sample
PAID CA2686+CA2687+CA2688.exe
Resource
win7-20241010-en
Malware Config
Extracted
formbook
4.1
cu29
qidr.shop
usinessaviationconsulting.net
68716329.xyz
nd-los.net
ealthironcladguarantee.shop
oftware-download-69354.bond
48372305.top
omeownershub.top
mall-chilli.top
ajakgoid.online
ire-changer-53482.bond
rugsrx.shop
oyang123.info
azino-forum-pro.online
817715.rest
layman.vip
eb777.club
ovatonica.net
urgaslotvip.website
inn-paaaa.buzz
reativedreams.design
upremehomes.shop
ames-saaab.buzz
phonelock.xyz
ideandseekvacations.xyz
77179ksuhr.top
ental-bridges-87553.bond
7win2.bet
ainan.company
5mwhs.top
hopp9.top
65fhgejd3.xyz
olandopaintingllc.online
n-wee.buzz
reshcasinoinfo2.top
5734.party
qtbyj.live
gil.lat
siabgc4d.online
fios.top
sed-cars-89003.bond
nlineschools-2507-001-sap.click
upiloffatemotors.online
ordf.top
achhonglan.shop
irex.info
oursmile.vip
leachlondonstore.online
asukacro.online
panish-classes-64045.bond
apita.top
srtio.xyz
kdsclci.bond
ochacha.sbs
oldsteps.buzz
yzq0n.top
npostl.xyz
ladder-cancer-symptoms-mine.sbs
400725iimfyuj120.top
3589.photo
rasilhojenoticias.online
ependableequipment.online
itusbandar126.info
ohns.app
f6b-crxy.top
Targets
-
-
Target
PAID CA2686+CA2687+CA2688.exe
-
Size
1.1MB
-
MD5
a4b51a4a802bbd22c815f978f47ea06f
-
SHA1
a8735f152d4e1e21d2ed3095821b909b022a4201
-
SHA256
069a4c2c42050c9037f6a11f9083b312c8bc3159fbe2b73f1e84760da762e6a8
-
SHA512
2733cd65bb29eaedf08dc0a9a4e577e01b4198240edc1c461e9efe78145071970c5116849f7a37d6a7470ed0c7b82ce6b40ed9df7c1aa011406ba2f158f405d8
-
SSDEEP
24576:WfmMv6Ckr7Mny5Qt4BoW8YCj0cdbtMQ6gLgj:W3v+7/5Qt4BoW8O+jgj
-
Formbook family
-
Formbook payload
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-