General
-
Target
Quotation.exe
-
Size
673KB
-
Sample
241112-hbrjysxbqg
-
MD5
0a4e34ccc6e3e118f225a4f38f731a14
-
SHA1
d8f89c49dbf6376607ea5379963bd95973fbfd18
-
SHA256
5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900
-
SHA512
9fe90ed6095223ee98eb1372708cf77c7b2cd2482899bded7bd9f99f823afdeb89370309e0a087000e4345dab4b10a428ffd1d0afa486b7091f8fc3f30d0cc70
-
SSDEEP
12288:1XFAO9mjNkvzScpPdK/Pr595FUCCVjscJ4nX0q2mY9+QQh3HEc:1XFNQyvzSYlCNIV+nX0q2I3HEc
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Malware Config
Extracted
formbook
4.1
hy29
obswell.online
etflix.luxury
ulunguwethu.store
ulbcenter.shop
nswering-service-mi-de-tt.click
upport-marketplace84.click
wepxbd163.lat
mplants-doctors.today
aofexf90yj.top
hermodynamic.space
dfg3n489.cyou
off.gay
alkak.cam
ijanarko.net
7tl.site
yaanincma.store
ires-47022.bond
elek4dalt77.xyz
foxsakepeople.online
ndefeatedqs.shop
ordseetouristik.reisen
eviewmywebsite.xyz
igitalcommandos.net
eqtech.net
5655600.xyz
rbis.site
entures-sharp.today
atrixslotviral.xyz
zrk148.ink
nline-advertising-18349.bond
unnify.net
ylosnackpark.online
sakasouzoku.net
emonslayerlatinclub.xyz
tus.live
tm189vip.live
eintix.store
oinflogo.xyz
nline-gaming-16655.bond
uyglp.one
ihjp69483.vip
n6n.xyz
veriox.xyz
limtightwaistkh.shop
roelitecraft.mom
eifeigou.top
inak.net
audesa.shop
ealclick.club
oktopus.kids
elisiaco.shop
xvsk.global
littlebitoffaith.net
dc188link04.xyz
tagprobe.band
orldlullaby.net
hswe.top
ultankinglogin.world
ustdoit.store
bhishekanand.biz
erminalplanner.app
oopia-faktura.info
a-consulting.online
owboyaero.net
84jys301.top
Targets
-
-
Target
Quotation.exe
-
Size
673KB
-
MD5
0a4e34ccc6e3e118f225a4f38f731a14
-
SHA1
d8f89c49dbf6376607ea5379963bd95973fbfd18
-
SHA256
5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900
-
SHA512
9fe90ed6095223ee98eb1372708cf77c7b2cd2482899bded7bd9f99f823afdeb89370309e0a087000e4345dab4b10a428ffd1d0afa486b7091f8fc3f30d0cc70
-
SSDEEP
12288:1XFAO9mjNkvzScpPdK/Pr595FUCCVjscJ4nX0q2mY9+QQh3HEc:1XFNQyvzSYlCNIV+nX0q2I3HEc
-
Formbook family
-
Guloader family
-
Formbook payload
-
Loads dropped DLL
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
4add245d4ba34b04f213409bfe504c07
-
SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
-
SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
-
SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
-
SSDEEP
192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
Score3/10 -