General
-
Target
7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704
-
Size
693KB
-
Sample
241217-n3rxpaylgt
-
MD5
eb3553d7605cd30697dae8b513ff6341
-
SHA1
242ddea5e4a332227601c7c5ab433ef051f493e0
-
SHA256
7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704
-
SHA512
3fc226364bc3d6f8245460deda845fe6ad4ab31e4becb44bca4bca690358537e3635cc9457e71fdd81f8bc6c532756777a2ab09b264fd359d3a42823fab1d83a
-
SSDEEP
12288:AW3lK5SX0mH7pCJVMLqc34rB+5m430uJtLL8ROLPOeZb7bnxGzmNpsxIKF/PBIYU:DpCJVGqcorMsbuHwOLPOeZfbnosCBPm5
Static task
static1
Behavioral task
behavioral1
Sample
7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe
Resource
win7-20241010-en
Malware Config
Extracted
formbook
4.1
sg11
rivileged.shop
itagomes.net
uncnp.shop
oodieshub.store
511110.com
vilertb.xyz
amlaketelaotions.online
arehouse-inventory-17910.bond
bwnkyjm.top
etrocognizant.info
rlokna.online
dgib.bid
vhgr.link
5106.loans
ollywoodbets.study
ndrewhussie.social
orkouttracker.net
odvoices.help
three6.buzz
gilesuite.app
2104.vip
fewd.boutique
enghis-solution.online
tpgamejagoan303.store
etsimple.dev
leaning-services-17930.bond
ountapi.net
thos-team.icu
fricamusicalworldtour.world
esus-game.site
ystest.info
uzgarotokurtarici.online
avelk.xyz
arax.online
rotechassisten.store
megaenz.xyz
orldlibertyfinanical.xyz
istribution-scroli.net
kwiqe.info
tbjqo.info
ingkong888.icu
etfamily.xyz
omoconectar.info
hoknows.life
osledniybogatyrnaslede.online
yotosphere.site
ensa777gacor.site
zxl.top
team-picturesys.online
iamesesandwichonsol.fun
ightyoak.industries
vdal.info
p663.top
opc.top
uy-now-pay-later-48656.bond
c5io1wz6.asia
oxboy.gay
owboytrader.online
ackpotrummy.icu
agorajaku4d.site
airplay365.net
eritagesportsb.shop
583377.app
istrictec.shop
ojws.website
Targets
-
-
Target
7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704
-
Size
693KB
-
MD5
eb3553d7605cd30697dae8b513ff6341
-
SHA1
242ddea5e4a332227601c7c5ab433ef051f493e0
-
SHA256
7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704
-
SHA512
3fc226364bc3d6f8245460deda845fe6ad4ab31e4becb44bca4bca690358537e3635cc9457e71fdd81f8bc6c532756777a2ab09b264fd359d3a42823fab1d83a
-
SSDEEP
12288:AW3lK5SX0mH7pCJVMLqc34rB+5m430uJtLL8ROLPOeZb7bnxGzmNpsxIKF/PBIYU:DpCJVGqcorMsbuHwOLPOeZfbnosCBPm5
-
Formbook family
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-