General
-
Target
VBshqUbZtSxUibM.exe
-
Size
605KB
-
Sample
241213-n8447sxphy
-
MD5
5219b5632bdd4d2bf00ca0405660a8cd
-
SHA1
118b516281a7f9d07e23014611e3a0c5148ba2d6
-
SHA256
6ce77c20aa2bb6bd48fe6255c91a4167fd81215ed4f4fec78c7387ef2247ae7b
-
SHA512
998748303f20e88d0239cb7cf5fe8ce055c64c27085d129f174f10705bb9ce2cb838b59da7bed922fe069e03624dffb7306f482966e5bdb2df6481f6c7b6746f
-
SSDEEP
12288:lkjnD7Oh7Ch0pUCxtrqeZx1Kufvye6vvc3JZgPeAp0:anD7OhM0nx1t/KufvyeOwgb
Static task
static1
Behavioral task
behavioral1
Sample
VBshqUbZtSxUibM.exe
Resource
win7-20241010-en
Malware Config
Extracted
formbook
4.1
sx01
r-salessolutions.xyz
jdh1.info
olar-panel-jobs-93084.bond
aebrasil.shop
oshua-xaaaa.buzz
xzkm.shop
nitedviplumbing.net
nnevateknoloji.xyz
rg-a.biz
indow-replacement-34091.bond
uyersagent3percent.net
ostbag.net
ibosolv.net
ahve.today
ophotshotjobs.today
emoreez.art
ift-chairs-94905.bond
okerdom-e.best
stagr.fun
irtyf-ingrancher.info
isviral.xyz
000rtp10.lat
tonomushotel.tech
26kd.shop
tarrypath.click
athroomremodeling-au.bond
ruthu.art
reatindiagame.net
oyroom.top
imusol.xyz
acuum-cleaner-36278.bond
psantennas.center
d1ot18.top
ybird.click
reenwitchery.shop
verythingtoys.net
j6t.xyz
surionatt.info
ronzon.tech
0240725pay.vip
ressfitting.info
itchen-deals-68231.bond
unvcxt.shop
hances.pro
ar-deals-15908.bond
xana.shop
onfirme-5.online
augdfgi.pro
romocionesguajaraz.info
etry.tech
bckorea.net
zcase.online
kksoyuz.online
sychology-degree-49198.bond
resdai.xyz
-bot-pasha01.buzz
aleemtips.online
allnyy8.shop
elso.app
onacat.online
gowelcomeflingofswish.homes
agamentospolo.online
24bm205er.autos
ulinary-schools-68403.bond
aggiemonroe.net
Targets
-
-
Target
VBshqUbZtSxUibM.exe
-
Size
605KB
-
MD5
5219b5632bdd4d2bf00ca0405660a8cd
-
SHA1
118b516281a7f9d07e23014611e3a0c5148ba2d6
-
SHA256
6ce77c20aa2bb6bd48fe6255c91a4167fd81215ed4f4fec78c7387ef2247ae7b
-
SHA512
998748303f20e88d0239cb7cf5fe8ce055c64c27085d129f174f10705bb9ce2cb838b59da7bed922fe069e03624dffb7306f482966e5bdb2df6481f6c7b6746f
-
SSDEEP
12288:lkjnD7Oh7Ch0pUCxtrqeZx1Kufvye6vvc3JZgPeAp0:anD7OhM0nx1t/KufvyeOwgb
-
Formbook family
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-