General
-
Target
a6d2a47171f9630a8db62eb4001e196dfbad94cf40638e108cc649883d1bc069.exe
-
Size
621KB
-
Sample
241205-s8rw4a1kfx
-
MD5
b631685c5ef9ee26ded25c76ab3eda27
-
SHA1
03696b36c4838440cf8def9687117745c9edbd19
-
SHA256
a6d2a47171f9630a8db62eb4001e196dfbad94cf40638e108cc649883d1bc069
-
SHA512
62fe2308ad1490495ec283027e2f07c7d5179ba9a327791de0b98a5f29db4ea3c721d3866674cedcb4033153ff5515d7f5bdc17d547191519dba70cd1c483134
-
SSDEEP
12288:tLczRLw1+27aPipUXT8eseyW2dv1WlYpXJk1jJT8CWqpqJ4uSYGExH0z:dctLw1+AaPOUXIjew1Umsj+0q2
Static task
static1
Behavioral task
behavioral1
Sample
a6d2a47171f9630a8db62eb4001e196dfbad94cf40638e108cc649883d1bc069.exe
Resource
win7-20241023-en
Malware Config
Extracted
formbook
4.1
cu29
qidr.shop
usinessaviationconsulting.net
68716329.xyz
nd-los.net
ealthironcladguarantee.shop
oftware-download-69354.bond
48372305.top
omeownershub.top
mall-chilli.top
ajakgoid.online
ire-changer-53482.bond
rugsrx.shop
oyang123.info
azino-forum-pro.online
817715.rest
layman.vip
eb777.club
ovatonica.net
urgaslotvip.website
inn-paaaa.buzz
reativedreams.design
upremehomes.shop
ames-saaab.buzz
phonelock.xyz
ideandseekvacations.xyz
77179ksuhr.top
ental-bridges-87553.bond
7win2.bet
ainan.company
5mwhs.top
hopp9.top
65fhgejd3.xyz
olandopaintingllc.online
n-wee.buzz
reshcasinoinfo2.top
5734.party
qtbyj.live
gil.lat
siabgc4d.online
fios.top
sed-cars-89003.bond
nlineschools-2507-001-sap.click
upiloffatemotors.online
ordf.top
achhonglan.shop
irex.info
oursmile.vip
leachlondonstore.online
asukacro.online
panish-classes-64045.bond
apita.top
srtio.xyz
kdsclci.bond
ochacha.sbs
oldsteps.buzz
yzq0n.top
npostl.xyz
ladder-cancer-symptoms-mine.sbs
400725iimfyuj120.top
3589.photo
rasilhojenoticias.online
ependableequipment.online
itusbandar126.info
ohns.app
f6b-crxy.top
Targets
-
-
Target
a6d2a47171f9630a8db62eb4001e196dfbad94cf40638e108cc649883d1bc069.exe
-
Size
621KB
-
MD5
b631685c5ef9ee26ded25c76ab3eda27
-
SHA1
03696b36c4838440cf8def9687117745c9edbd19
-
SHA256
a6d2a47171f9630a8db62eb4001e196dfbad94cf40638e108cc649883d1bc069
-
SHA512
62fe2308ad1490495ec283027e2f07c7d5179ba9a327791de0b98a5f29db4ea3c721d3866674cedcb4033153ff5515d7f5bdc17d547191519dba70cd1c483134
-
SSDEEP
12288:tLczRLw1+27aPipUXT8eseyW2dv1WlYpXJk1jJT8CWqpqJ4uSYGExH0z:dctLw1+AaPOUXIjew1Umsj+0q2
-
Formbook family
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-