General
-
Target
01c879fb6063308d10f1958803f5633b.bin
-
Size
564KB
-
Sample
241114-bcpnesvrgp
-
MD5
efc10268a90ef3292d5677ede421930b
-
SHA1
e07e9d33b81f9247b7074bfeebf23f91ba680dfe
-
SHA256
093a6b624219e576a0010b3dd4470faaec5dfd2d81a3419e5f8b6fd9dce7db3e
-
SHA512
ee42c5e4131c94115782a0d0ade390c1f87328305b89c5e9c9b9266d04fb31e19666c81cc4d87e52b3d28e31f9a4d0d0a1797f8d6e36e1cdf068d1462affeb25
-
SSDEEP
12288:Phf020m3Zzi3+98/Qq04INenZckkyO5RGzS9wAcoa1D9PqZPbG:PZ0lE8/QvNenZPkJ+zS9ZK1D9MPbG
Static task
static1
Behavioral task
behavioral1
Sample
4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f.exe
Resource
win7-20241023-en
Malware Config
Extracted
formbook
4.1
m17o
kzqh72.top
arket-obybqq.xyz
afechoice.click
ote-knplpa.xyz
aqgpie.xyz
orker-ornp.xyz
he-beds321.today
ut-nlvv.xyz
31231827.xyz
milymariephotography.net
wquqo.click
veu-where.xyz
mjcpo-pick.xyz
yself-lpnbdl.xyz
austoowagosha.net
ive-wgag.xyz
lay-drift-palace.xyz
old-vubgv.xyz
ideo-shooting-courses.today
ntendsisaiasjazmin.shop
rangphimhay.net
ingsai.top
31231869.xyz
okue-least.xyz
actose-free-nutrition.click
ghu-yourself.xyz
umgi-paper.xyz
koj-themselves.xyz
wax-magazine.xyz
ncenseproln.shop
kpl-0166.top
lygww-box.xyz
espond-sspb.xyz
uniaslot77-azul.click
olisticuniversal.design
rawlstarsbrasil.shop
vvimy.top
igrct-itself.xyz
euauhugonisyallaer.shop
allout76microsoft.shop
oedavn.shop
ovie-vkgei.xyz
ssk-even.xyz
lc.mobi
nyoy-adult.xyz
killup2work.net
1684.app
xecutive-kutoax.xyz
eneration-vxej.xyz
-navi.net
elemqio-ojuu.top
xpl-yet.xyz
uthor-pfndoi.xyz
ecimalplace.net
yikb-vote.xyz
39581.top
ischi-waschi.jetzt
31232158.xyz
ucksvip.top
unstylingt.xyz
pike-volnix.click
5ddc2.xyz
2rbet.mobi
uivlio.xyz
oolgege.top
Targets
-
-
Target
4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f.exe
-
Size
586KB
-
MD5
01c879fb6063308d10f1958803f5633b
-
SHA1
691d2833dcc4a2a1f2e8f746f3f9bb5ceaf8cf33
-
SHA256
4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f
-
SHA512
f1fb9fef3108c04fa893111da8c4e52b893a22ddc4cc18f135774c04fe6f0b90e52a87fe251fe0d2f93df9a508dd4f1bdc687dbbe67103a919675cd87bd074de
-
SSDEEP
12288:U0nsD80+C/vmwf3PR7alWqgvZSmFiG92PfVGDr5Oi:3nR4/Zf57al1g192gDr5O
-
Formbook family
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-