General
-
Target
44ab353624b9e867ae31a0523437ed8e321f361d248b471c15bd2902255280f3.exe
-
Size
651KB
-
Sample
241030-ct4pcavbnd
-
MD5
1660c33123052f15e4e63891f23ddd1e
-
SHA1
3b93eb0499260f494066d6a28f1238c1c440b04f
-
SHA256
44ab353624b9e867ae31a0523437ed8e321f361d248b471c15bd2902255280f3
-
SHA512
6c55d8bcfc60d513ae59cae83eb0ec0ee4b740dd0305664f3997fd9758104e79238d8f9304345de94c9b76ed8c6fd03f8e66ab72c9f49d55d8a18b5388b58351
-
SSDEEP
12288:JMRkVqoYve4eWCRO5W9Se/DETPCvTtQdH41lIaPLLrR:eRkVPP49Ip4ebELCvJQx45V
Static task
static1
Behavioral task
behavioral1
Sample
44ab353624b9e867ae31a0523437ed8e321f361d248b471c15bd2902255280f3.exe
Resource
win7-20241023-en
Malware Config
Extracted
formbook
4.1
dn13
5q53s.top
f9813.top
ysticsmoke.net
ignorysingeysquints.cfd
yncsignature.live
svp-their.xyz
outya.xyz
wlkflwef3sf2wf.top
etterjugfetkaril.cfd
p9eh2s99b5.top
400108iqlnnqi219.top
ynsu-condition.xyz
ndividual-bfiaen.xyz
anceibizamagazine.net
itrussips.live
orkcubefood.xyz
lindsandfurnishings.shop
ajwmid.top
pigramescentfeatous.shop
mbvcv56789.click
rmei2-cnpj.website
81uu.top
cis.services
ptionsxpress-17520.vip
ltimatraceglow.vip
apu4dmain.cfd
hckc-sell.xyz
nough-smae.xyz
fsoiw-hotel.xyz
mile-hkajwx.xyz
ay-hbcsg.xyz
articulart.net
ozezae7.pro
asy-jatcrz.xyz
wiftsscend.click
tinky.vip
ould-ktlgl.xyz
vagames.pro
sncmk.shop
trategy-eyewna.xyz
orty.pro
hanprojects.tech
ronsoy.vip
aoxiangwu.top
8tsl.fashion
ashersmeaningmellitz.cfd
ood-packing-iasehq19x224.today
oldier-zjfuu.xyz
ysterywarrior932.top
omercialec.shop
ashclub.xyz
trongenergetichealth.top
addedcaitiffcanzos.shop
ack-gtiij.xyz
nformation-gdrs.xyz
ouwmsoe.top
apermatepens.net
5i34whsisp.top
appen-zuxs.xyz
trennebaffinbayamon.cfd
nablerententeewart.shop
xpert-private-tutors.today
zzw-tv.xyz
ffvd-traditional.xyz
31231851.xyz
Targets
-
-
Target
44ab353624b9e867ae31a0523437ed8e321f361d248b471c15bd2902255280f3.exe
-
Size
651KB
-
MD5
1660c33123052f15e4e63891f23ddd1e
-
SHA1
3b93eb0499260f494066d6a28f1238c1c440b04f
-
SHA256
44ab353624b9e867ae31a0523437ed8e321f361d248b471c15bd2902255280f3
-
SHA512
6c55d8bcfc60d513ae59cae83eb0ec0ee4b740dd0305664f3997fd9758104e79238d8f9304345de94c9b76ed8c6fd03f8e66ab72c9f49d55d8a18b5388b58351
-
SSDEEP
12288:JMRkVqoYve4eWCRO5W9Se/DETPCvTtQdH41lIaPLLrR:eRkVPP49Ip4ebELCvJQx45V
-
Formbook family
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-