General
-
Target
1d7608383da2756b65cc19e91419acd47290ee520b76a760bb5089f1738a7778
-
Size
694KB
-
Sample
241115-stadhawflc
-
MD5
ec40a248a16d96dc142dbb3790ca6975
-
SHA1
87eaa2b463ecf0321eb2f82869dcfdc2cb780f46
-
SHA256
1d7608383da2756b65cc19e91419acd47290ee520b76a760bb5089f1738a7778
-
SHA512
6bbe02275246e09819a870f70c7adc22788885a2182d734561180dc5a6c08b6ff8f9483be8fbd3e5085da02554adde0d464aab4d8aa770fe08f4e19f2fcb718f
-
SSDEEP
12288:qW3lK5SX0mH7vCJVMaeGr5m+ghXUoyFXwPOs3HI4PZe3Ue0W+c3w5cfnEyYEW:RvCJVM05m+ghyoOs3PPZLW/goEyzW
Static task
static1
Behavioral task
behavioral1
Sample
1d7608383da2756b65cc19e91419acd47290ee520b76a760bb5089f1738a7778.exe
Resource
win7-20240729-en
Malware Config
Extracted
formbook
4.1
dn13
5q53s.top
f9813.top
ysticsmoke.net
ignorysingeysquints.cfd
yncsignature.live
svp-their.xyz
outya.xyz
wlkflwef3sf2wf.top
etterjugfetkaril.cfd
p9eh2s99b5.top
400108iqlnnqi219.top
ynsu-condition.xyz
ndividual-bfiaen.xyz
anceibizamagazine.net
itrussips.live
orkcubefood.xyz
lindsandfurnishings.shop
ajwmid.top
pigramescentfeatous.shop
mbvcv56789.click
rmei2-cnpj.website
81uu.top
cis.services
ptionsxpress-17520.vip
ltimatraceglow.vip
apu4dmain.cfd
hckc-sell.xyz
nough-smae.xyz
fsoiw-hotel.xyz
mile-hkajwx.xyz
ay-hbcsg.xyz
articulart.net
ozezae7.pro
asy-jatcrz.xyz
wiftsscend.click
tinky.vip
ould-ktlgl.xyz
vagames.pro
sncmk.shop
trategy-eyewna.xyz
orty.pro
hanprojects.tech
ronsoy.vip
aoxiangwu.top
8tsl.fashion
ashersmeaningmellitz.cfd
ood-packing-iasehq19x224.today
oldier-zjfuu.xyz
ysterywarrior932.top
omercialec.shop
ashclub.xyz
trongenergetichealth.top
addedcaitiffcanzos.shop
ack-gtiij.xyz
nformation-gdrs.xyz
ouwmsoe.top
apermatepens.net
5i34whsisp.top
appen-zuxs.xyz
trennebaffinbayamon.cfd
nablerententeewart.shop
xpert-private-tutors.today
zzw-tv.xyz
ffvd-traditional.xyz
31231851.xyz
Targets
-
-
Target
1d7608383da2756b65cc19e91419acd47290ee520b76a760bb5089f1738a7778
-
Size
694KB
-
MD5
ec40a248a16d96dc142dbb3790ca6975
-
SHA1
87eaa2b463ecf0321eb2f82869dcfdc2cb780f46
-
SHA256
1d7608383da2756b65cc19e91419acd47290ee520b76a760bb5089f1738a7778
-
SHA512
6bbe02275246e09819a870f70c7adc22788885a2182d734561180dc5a6c08b6ff8f9483be8fbd3e5085da02554adde0d464aab4d8aa770fe08f4e19f2fcb718f
-
SSDEEP
12288:qW3lK5SX0mH7vCJVMaeGr5m+ghXUoyFXwPOs3HI4PZe3Ue0W+c3w5cfnEyYEW:RvCJVM05m+ghyoOs3PPZLW/goEyzW
-
Formbook family
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-