General
- Target 2Cly2ggpsNFKkgW.exe
- Size 412KB
- Sample200814-t126zwpbhj
- SHA256 bf694824d6cbf6fba77ce087678b03ee8243a245b4b730eb55fb83e83b8dff8e
- MD5 1dd3ad264f214e381033184570606953
- SHA1 d35eef926c251bd9c03fff1604d4a6d45a79261c
- SHA512 09cace5ee24ff2999303bf5873291005f4539fa9bc7046ee290e6040f6856cbf36b248e50d28f46f69db000a2b63f90845455d4611dbaf52e4fea6c538d526b6
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
2Cly2ggpsNFKkgW.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.regulars6.com/w5fk/
-
wphi.net
-
variable-annuities.net
-
jp-payment-restriction.com
-
xcashmere.com
-
matematikmarketi.com
-
searchandresearch.ltd
-
strategyformat.com
-
redirecttacorp.com
-
smile-factory-misato.com
-
nrwlr.info
-
quboti.com
-
miraeevent.com
-
proroofclean.com
-
xmymzp.com
-
abettertoupgrade.win
-
sixstarscleaning.com
-
miyoqf.info
-
lightingiot.net
-
onlinesanalkart.biz
-
tapdndheros.com
-
ladazapchasti.info
-
fransweet.com
-
xjhrzp.com
-
rekatec.com
-
gahawuti85.win
-
gdprmydata.com
-
rss2blog.com
-
mentors36.com
-
07km.top
-
hotgirlswonderfulvideo.site
-
knucklechux.com
-
123tamiltv.com
-
soccer-perform.com
-
0x989903.net
-
kctrendstars.com
-
shanghailc.com
-
realestateinvestinga2z.com
-
neymassage.com
-
reputationhero.online
-
theninthzone.com
-
michigancommunitycollective.com
-
silk-knot-membership.com
-
jadewigginsdesign.com
-
isabellaclarkeofficial.com
-
musiconholdexperts.com
-
hotcam4.com
-
newdlmagicstore.com
-
womensfitnesshub.com
-
tuzivr.com
-
ainosansyanpoo.com
-
paniqinslo.com
-
steakhouseknutsford.com
-
97scly.com
-
altair2008.com
-
parissummerolympics2024.online
-
louisgray.net
-
hamxw.com
-
briccountries.net
-
daksma2019.com
-
wordsearchpuzzlefriends.com
-
fadianji36.com
-
dainikjagrannews.com
-
singletracks-bike-park.com
-
woodstoclkhyundai.com
Targets
-
- Target 2Cly2ggpsNFKkgW.exe
- Size 412KB
- SHA256 bf694824d6cbf6fba77ce087678b03ee8243a245b4b730eb55fb83e83b8dff8e
- MD5 1dd3ad264f214e381033184570606953
- SHA1 d35eef926c251bd9c03fff1604d4a6d45a79261c
- SHA512 09cace5ee24ff2999303bf5873291005f4539fa9bc7046ee290e6040f6856cbf36b248e50d28f46f69db000a2b63f90845455d4611dbaf52e4fea6c538d526b6
- MD5 SHA1 SHA512
-
Formbook Payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext