General
- Target 0mwSprBZ47mNQyY.exe
- Size 665KB
- Sample200812-9hpcdz8xle
- SHA256 ea74eac48adf2b19c3102578cb14ee0cd1d51f5e5e1da2fb4ab5b0d3f7e91827
- MD5 0ad8631c3de13ef3867d5d887b6d2faa
- SHA1 725ac23500bde9d94f71ebdfb2e1486a9be9108d
- SHA512 dcf0634540f3fc26b22b8f9c2282ef2a68afc96cda9288add952e42f0f3ca4832b694b49b4546e489b7bebf8907b310c13d7aa6bb7fa5d6a58901cfd6ccbc0fa
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
0mwSprBZ47mNQyY.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.regulars6.com/zaer/
-
lipbombed.com
-
abmeadors-insurance.biz
-
devtechsolar.com
-
austin-roofingcontractor.com
-
makavelioffspring.com
-
sredalab.com
-
attractionvideo.com
-
designmouldingterrain.com
-
nicerecipes15.info
-
gdclosalcores.com
-
jesussaysyesorno.online
-
forpleasantsleep.com
-
cynthiascountrystore.com
-
thedisinsiderbeta.com
-
dushixue.com
-
eveitis.com
-
huyue-jixie.com
-
buoyantcoin.com
-
london-security-shutters.com
-
fokusworld.com
-
teleclara.com
-
songlyricssearchengine.online
-
asiapremierdev.com
-
hbhjcf.com
-
jany2009.com
-
avdol.com
-
busrauyar.com
-
bfuee.info
-
abujalfa.com
-
storagearchivequick.win
-
unotoe.com
-
themedianewsroom.com
-
lifehackvideos.com
-
mailwizz.online
-
recuerdosmemorables.com
-
hi-digiq.com
-
cru.email
-
formations.house
-
1024eeef.info
-
candsmoguls.info
-
upstreetbrands.com
-
nohy-su-sexy.com
-
aryu.ltd
-
intratri.info
-
paragnishar.com
-
ngnmx.top
-
booksforgeeks.com
-
bjgsbg64.com
-
brokoff.com
-
68882k.com
-
ineedhelprepairingmycredit.info
-
electricblankets.online
-
aporadhbarta.net
-
thomasmyeong.com
-
translationsabc.net
-
howshot.net
-
drsexo.com
-
umconnectumcsn.com
-
sinamashini.com
-
0n4ninemega.men
-
juzi-it.com
-
apclo.net
-
511xx.com
-
vpmeat.wales
Targets
-
- Target 0mwSprBZ47mNQyY.exe
- Size 665KB
- SHA256 ea74eac48adf2b19c3102578cb14ee0cd1d51f5e5e1da2fb4ab5b0d3f7e91827
- MD5 0ad8631c3de13ef3867d5d887b6d2faa
- SHA1 725ac23500bde9d94f71ebdfb2e1486a9be9108d
- SHA512 dcf0634540f3fc26b22b8f9c2282ef2a68afc96cda9288add952e42f0f3ca4832b694b49b4546e489b7bebf8907b310c13d7aa6bb7fa5d6a58901cfd6ccbc0fa
- MD5 SHA1 SHA512
-
Formbook Payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext