General
-
Target
f28fc7b2cb76f0a714ef1e43b37ec0f5aa6c497d25d7de4379e8e0b91913d1c0
-
Size
986KB
-
Sample
220805-mw9ngsbge7
-
MD5
557232ed6bcc3043cba02aedcbc96891
-
SHA1
bd739f8686a3a535b9d2faee8990c77f0de06884
-
SHA256
f28fc7b2cb76f0a714ef1e43b37ec0f5aa6c497d25d7de4379e8e0b91913d1c0
-
SHA512
d24bab222f53b70ec8e551a81ae5524991c58baa8602fdcd65d37ece4bfeee0b470ba3177acd0cf2c4f3b5e7b7bdd7ae6a88b8e12c24e7b5b0610e465b205d9d
Static task
static1
Behavioral task
behavioral1
Sample
f28fc7b2cb76f0a714ef1e43b37ec0f5aa6c497d25d7de4379e8e0b91913d1c0.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
f28fc7b2cb76f0a714ef1e43b37ec0f5aa6c497d25d7de4379e8e0b91913d1c0.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
formbook
4.1
t3c9
waidfu.com
sjglyshsv.com
sdztgy.com
health-magazines.info
bajoarmadura.com
oxian.xyz
jonspearman.com
fusodu.online
jx1718.net
arminva6tinderella.xyz
susuhiwah.com
novotherm.online
superbloomerz.com
kuaida56.com
74hc86.com
stellumml.com
neurocalibration.com
pinkspirit.store
solitaipat.com
eassiy.com
w-coinbase.xyz
transliberation.space
food2goscunthorpeonline.com
as2082m.icu
goodhistoryhealth.com
albertojanderson.space
idc169.com
silverholleorganicfarms.com
influxpr.com
lechecondensada.info
airyflamy.com
rangersmix.com
muadogiadungtot.site
feldfire.store
splitdrinks.com
lbzyfj.com
mydailycash.online
ifa-samsung.com
bzfjm.net
001qr.com
elylil.com
coloradogives365.com
vmpapp.com
yourcoachsteph.com
annalenaroeder.com
gsolartech.com
vsecom.net
digihouse.biz
paxof.com
spectrumfxstudio.com
cwmjcs.com
borilicious.com
bigmamma1121.com
future.hockey
billionaero.com
ebavconnect.com
essntialstore.com
hillbumper.com
mlnxsw.xyz
bicyclelover.com
sabjibajar.com
abudhabityrerepair.com
birdpet.store
www6142.com
kingnat.xyz
Targets
-
-
Target
f28fc7b2cb76f0a714ef1e43b37ec0f5aa6c497d25d7de4379e8e0b91913d1c0
-
Size
986KB
-
MD5
557232ed6bcc3043cba02aedcbc96891
-
SHA1
bd739f8686a3a535b9d2faee8990c77f0de06884
-
SHA256
f28fc7b2cb76f0a714ef1e43b37ec0f5aa6c497d25d7de4379e8e0b91913d1c0
-
SHA512
d24bab222f53b70ec8e551a81ae5524991c58baa8602fdcd65d37ece4bfeee0b470ba3177acd0cf2c4f3b5e7b7bdd7ae6a88b8e12c24e7b5b0610e465b205d9d
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-