General
-
Target
20241211TT.exe
-
Size
743KB
-
Sample
241219-h5jq7svjdv
-
MD5
96e86e405d7562e778fa380a07ff8ff7
-
SHA1
c5f9c54d9bc639e7f84447e8d0b79323ef128b02
-
SHA256
bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a
-
SHA512
ae7ad2150f8c9b0037372af0092570d9557cbff7e6a5b260407211410c4457b105416a10a2c30b8ceeccf90ab6cf5e5970b1c53a5861af90e859c8924c1a8c51
-
SSDEEP
12288:uU8f2uE1zDMjwPCBchAASH2gDkPN0IJzI/4yoKAaKKiq08f2:uUu2uOUjw2chAAXgYmIJzI/4yoKAL60Z
Static task
static1
Behavioral task
behavioral1
Sample
20241211TT.exe
Resource
win7-20240903-en
Malware Config
Extracted
formbook
4.1
k49s
ufberyrubiest.shop
tpanekatotosite.top
esona805158762.xyz
earing-tests-15487.bond
rediksitiraitoto.xyz
tore-playstore.online
mpresarialpx38.online
ufxusa.net
reativedesigns.lat
leaning-services-47614.bond
959725nptklnq923.top
treziop.xyz
eubel-bestseller.online
uynewcars.xyz
all-panels-74750.bond
erviceninjas.vip
arectoroffice.xyz
oviesgpt.app
ractors-22059.bond
rakenfitness.info
qatn10.shop
r-dresses-comments-25j.today
ejao.online
iningtruckszone.today
573132.top
cn5u.digital
qatn10.shop
56tm74ah.autos
urkiyekahvecisi.xyz
zincloud.shop
asuraplay77.info
ementia-treatment-40095.bond
lianzatrading.online
otive.app
imba69luckyspin.sbs
ainlamphumidifier.shop
martfile.app
at-casino-sh.buzz
uluthtradingsale.club
my755h.top
eflexive.asia
aboresdemexico.shop
nvestorsinbox.net
tp-turbobet77.live
vcxcvfwe22.shop
nlineredirect.cloud
ueyunlaihong.top
uperfastservic.online
itetalk.net
5940.club
oftware-avast.top
articuli.cloud
atin-dating-52735.bond
taticsitescanary.net
tr77.bet
ift-chairs-17834.bond
viviendapro.online
w165.top
martct.info
odiacdigitaltwin.cloud
ires-66750.bond
xtaapp.fun
63719.vip
in-up-casino-skf2.top
ir-condition-81494.bond
Targets
-
-
Target
20241211TT.exe
-
Size
743KB
-
MD5
96e86e405d7562e778fa380a07ff8ff7
-
SHA1
c5f9c54d9bc639e7f84447e8d0b79323ef128b02
-
SHA256
bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a
-
SHA512
ae7ad2150f8c9b0037372af0092570d9557cbff7e6a5b260407211410c4457b105416a10a2c30b8ceeccf90ab6cf5e5970b1c53a5861af90e859c8924c1a8c51
-
SSDEEP
12288:uU8f2uE1zDMjwPCBchAASH2gDkPN0IJzI/4yoKAaKKiq08f2:uUu2uOUjw2chAAXgYmIJzI/4yoKAL60Z
-
Formbook family
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-