Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 20:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe
Resource
win7-20240903-en
General
-
Target
2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe
-
Size
7.1MB
-
MD5
8d832c37b858dc1a58a07208d1aeabe9
-
SHA1
ba99065bcf06ca0a982e378074c0588606e2a598
-
SHA256
b120a5a4ec9d40696f7823fbf1044b4c4a6e2793ba336917bd9246a6beea9385
-
SHA512
17b3e6f4623463c15962811cd57f61ccf9ef56bff91114fbfeda9aba2d36c60eedf4605ca6f2c6590fe027736d5d61d26b1afeeaf0c42997810a1ef81716029c
-
SSDEEP
196608:lR668aaELKR668aaEL4R668aaELeFIF0wu:lp8aa7p8aaZp8aap
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Remcos family
-
Xred family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3080 powershell.exe 60 powershell.exe 3156 powershell.exe 2168 powershell.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 5 IoCs
pid Process 3428 ._cache_2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 4684 Synaptics.exe 2648 Synaptics.exe 1540 Synaptics.exe 400 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2536 set thread context of 2524 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 103 PID 4684 set thread context of 1540 4684 Synaptics.exe 117 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3636 schtasks.exe 1944 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2800 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 60 powershell.exe 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 3156 powershell.exe 60 powershell.exe 3156 powershell.exe 4684 Synaptics.exe 4684 Synaptics.exe 4684 Synaptics.exe 4684 Synaptics.exe 2168 powershell.exe 4684 Synaptics.exe 4684 Synaptics.exe 3080 powershell.exe 4684 Synaptics.exe 2168 powershell.exe 3080 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe Token: SeDebugPrivilege 60 powershell.exe Token: SeDebugPrivilege 3156 powershell.exe Token: SeDebugPrivilege 4684 Synaptics.exe Token: SeDebugPrivilege 2168 powershell.exe Token: SeDebugPrivilege 3080 powershell.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 3428 ._cache_2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 2800 EXCEL.EXE 2800 EXCEL.EXE 2800 EXCEL.EXE 2800 EXCEL.EXE 2800 EXCEL.EXE 2800 EXCEL.EXE 2800 EXCEL.EXE 2800 EXCEL.EXE -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2536 wrote to memory of 60 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 97 PID 2536 wrote to memory of 60 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 97 PID 2536 wrote to memory of 60 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 97 PID 2536 wrote to memory of 3156 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 99 PID 2536 wrote to memory of 3156 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 99 PID 2536 wrote to memory of 3156 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 99 PID 2536 wrote to memory of 3636 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 101 PID 2536 wrote to memory of 3636 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 101 PID 2536 wrote to memory of 3636 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 101 PID 2536 wrote to memory of 2524 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 103 PID 2536 wrote to memory of 2524 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 103 PID 2536 wrote to memory of 2524 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 103 PID 2536 wrote to memory of 2524 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 103 PID 2536 wrote to memory of 2524 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 103 PID 2536 wrote to memory of 2524 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 103 PID 2536 wrote to memory of 2524 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 103 PID 2536 wrote to memory of 2524 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 103 PID 2536 wrote to memory of 2524 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 103 PID 2536 wrote to memory of 2524 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 103 PID 2536 wrote to memory of 2524 2536 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 103 PID 2524 wrote to memory of 3428 2524 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 104 PID 2524 wrote to memory of 3428 2524 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 104 PID 2524 wrote to memory of 3428 2524 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 104 PID 2524 wrote to memory of 4684 2524 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 105 PID 2524 wrote to memory of 4684 2524 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 105 PID 2524 wrote to memory of 4684 2524 2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe 105 PID 4684 wrote to memory of 2168 4684 Synaptics.exe 110 PID 4684 wrote to memory of 2168 4684 Synaptics.exe 110 PID 4684 wrote to memory of 2168 4684 Synaptics.exe 110 PID 4684 wrote to memory of 3080 4684 Synaptics.exe 112 PID 4684 wrote to memory of 3080 4684 Synaptics.exe 112 PID 4684 wrote to memory of 3080 4684 Synaptics.exe 112 PID 4684 wrote to memory of 1944 4684 Synaptics.exe 114 PID 4684 wrote to memory of 1944 4684 Synaptics.exe 114 PID 4684 wrote to memory of 1944 4684 Synaptics.exe 114 PID 4684 wrote to memory of 2648 4684 Synaptics.exe 116 PID 4684 wrote to memory of 2648 4684 Synaptics.exe 116 PID 4684 wrote to memory of 2648 4684 Synaptics.exe 116 PID 4684 wrote to memory of 1540 4684 Synaptics.exe 117 PID 4684 wrote to memory of 1540 4684 Synaptics.exe 117 PID 4684 wrote to memory of 1540 4684 Synaptics.exe 117 PID 4684 wrote to memory of 1540 4684 Synaptics.exe 117 PID 4684 wrote to memory of 1540 4684 Synaptics.exe 117 PID 4684 wrote to memory of 1540 4684 Synaptics.exe 117 PID 4684 wrote to memory of 1540 4684 Synaptics.exe 117 PID 4684 wrote to memory of 1540 4684 Synaptics.exe 117 PID 4684 wrote to memory of 1540 4684 Synaptics.exe 117 PID 4684 wrote to memory of 1540 4684 Synaptics.exe 117 PID 4684 wrote to memory of 1540 4684 Synaptics.exe 117 PID 1540 wrote to memory of 400 1540 Synaptics.exe 118 PID 1540 wrote to memory of 400 1540 Synaptics.exe 118 PID 1540 wrote to memory of 400 1540 Synaptics.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:60
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLznCuyzwk.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLznCuyzwk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp961.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3636
-
-
C:\Users\Admin\AppData\Local\Temp\2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\._cache_2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3428
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLznCuyzwk.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLznCuyzwk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7654.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1944
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Executes dropped EXE
PID:2648
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:400
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2800
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.1MB
MD58d832c37b858dc1a58a07208d1aeabe9
SHA1ba99065bcf06ca0a982e378074c0588606e2a598
SHA256b120a5a4ec9d40696f7823fbf1044b4c4a6e2793ba336917bd9246a6beea9385
SHA51217b3e6f4623463c15962811cd57f61ccf9ef56bff91114fbfeda9aba2d36c60eedf4605ca6f2c6590fe027736d5d61d26b1afeeaf0c42997810a1ef81716029c
-
Filesize
144B
MD566533a35a08c42a1ff93c5abef979352
SHA1557a1ed9a5698728478d8d90347acbac768ef439
SHA2566cb42f3a51a8719c88840db2da48ca12df4e0dbf81dbf953af28e79678f78f53
SHA51267342f9d59e81eab566146ff32325c137c95afda507a55d57d6e0c02d1926d4363847285949185f6e4fc149072321950ed83b45df13f0702e885ba153fb0a899
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD52f795f3c2091d5d456280e752df50872
SHA12f8e24e7545e982b182763715d5db25d86f642af
SHA25620dd530bfc3c1ad71a587338e9b8a7534f016fe9803a57767b583b8e68a672ae
SHA51224cd587143d268c7cc553ed6ad78f251442043da4b71d5ce808deb4c9ce6c9437afa5e5aa095cf71ca9993a2a03d0598481e118228292303808bb06c99d09d8b
-
Filesize
18KB
MD54a38e60bb3b6f462eee57019354064f0
SHA13152f98c84d07b652011fba17602a60e0d992e06
SHA256b73f8bd62ac331c6ba97187d9825c6214a3d2e9d619c5fe25f3751903e687535
SHA5123a58172b49b2d2d8f7fe839d80e626c52f8348d8c78c12c598181b5d18bd63ee92ed332159a34c99c654e44baf08381ec9d392c2362f9ad34a9bfc1a4d6fa587
-
C:\Users\Admin\AppData\Local\Temp\._cache_2024-11-19_8d832c37b858dc1a58a07208d1aeabe9_avoslocker_formbook_hijackloader_luca-stealer.exe
Filesize483KB
MD5f3b57ccad1c0a308635e17aa591e4038
SHA1ca67ad3c74523b844fc23563f7b288f0389fd645
SHA2565ad6b9a917f35be0a1d66c771069c2143ad765737eedd85436acbc0f95a4c0e7
SHA5125ed754a1b254e8a4b03e0445ac0081c94aaf179c2974827ce4ff10b7deb765d819243b2084212d7c91be9ddc07bf94f55e35f85564781b4124b61647a2f0977a
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
23KB
MD5fe88728bf54cd13c6ad3abf707673796
SHA1761552fb7fec9f69ebf47a21826d0224e91a85f0
SHA256781997cf854251c52ace6b7447c90b7995b42b500c6c8e996dcb008875ed32a4
SHA512d782658ea493fbfaba5985c948bd0293de23c1fda7249eed1262be130fe8cb2b86787d3f793caf6bb6aba35c61c6f351055b85f7bf8144cef65e00ff07e01305
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD555cbda19531a6f7fc135d32d28d61966
SHA183c3edead7b26b655da184d1fe9cd24ff0aafb32
SHA2560cdfbbf22acac24ee761179bd6dd8e568ede96d4889aab95a6521fa6f6e054cf
SHA5125b1dc350d67fd63b167bd2ee342eb88a93dc7170e733edc6d9521034bf4edb30448f4b475677163b1268bc7355e15148c4b71c359924f65e67c0afc86f61d8e3