General
- Target orden de compra.exe
- Size 380KB
- Sample200814-sbeft2w49s
- SHA256 2f9d83d844287396dcaf52b5c15c1dacc92bc4ae2e2777d24c8d09465037ace3
- MD5 2a30abd4d6db32bfc49a069c56ceb45c
- SHA1 dc1411169ccfac189b4370ce8342779051a65753
- SHA512 fa5110812d55c02e597b4ec890b6f40bcb23e66ecb79189f4d0e461cb87c40f4fb3a36cf6f3edf47b9c4ab9b784702751338399a5cfe14e9bd31ba3b8917403f
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
orden de compra.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.fex-tracks.com/kvsz/
-
okashyns.com
-
sbsgamedaejeon-two.com
-
drb77.com
-
top5dating.com
-
websprings.online
-
voizers.com
-
zenith.site
-
lahistoriade.com
-
qv85.com
-
armandonieto.com
-
priestvedic.com
-
jessandjeff.net
-
magic-desktop.com
-
jitaji.com
-
ldmeili.com
-
yuwanqingmy.com
-
buzhouorg.com
-
chaiseloungereviews.com
-
m2g8way.com
-
freespin-support.com
-
bocapvang.net
-
315px.com
-
eugeniobarros.tech
-
sif.email
-
xn--oorv2aj6bj7cds0d6p4b.com
-
polychips.com
-
grouptulip.win
-
landbank.site
-
bet365c.win
-
inbonz.com
-
outofthepark.today
-
jeaniney.com
-
weeip.com
-
dmoneylife.com
-
rticlubs.com
-
reisedating.com
-
marijuanadogbone.com
-
funippon.com
-
banknotesync.com
-
alexandre-boissard.com
-
valorartetattoo.com
-
savetheverse.com
-
specificpcshop.online
-
h0jt1y.accountant
-
jiqing3.com
-
alfaranakle.com
-
saft-store.com
-
wanderingcollective.com
-
santandermobi.online
-
557023.top
-
loulancaster.com
-
vedattelekom.com
-
jatinangorcity.com
-
goldencanaries.com
-
edgaralanbro.com
-
levelretail.com
-
taylorsandbek.com
-
upbeatnewyork.com
-
motoreselectricoschihuahua.com
-
hotair.wales
-
getawomantodoit.com
-
xiaoxiong365.com
-
cloudboxsupport.com
-
vecteur-u-shop.com
Targets
-
- Target orden de compra.exe
- Size 380KB
- SHA256 2f9d83d844287396dcaf52b5c15c1dacc92bc4ae2e2777d24c8d09465037ace3
- MD5 2a30abd4d6db32bfc49a069c56ceb45c
- SHA1 dc1411169ccfac189b4370ce8342779051a65753
- SHA512 fa5110812d55c02e597b4ec890b6f40bcb23e66ecb79189f4d0e461cb87c40f4fb3a36cf6f3edf47b9c4ab9b784702751338399a5cfe14e9bd31ba3b8917403f
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext