General
- Target PI6354.exe
- Size 562KB
- Sample200818-3ap8gt7ecn
- SHA256 9ddbf1453097473cfa4eb4c1a28a6f4a2ecdac3b24179e6fd88d3444bf96ec23
- MD5 e865f64e36ea59737f07f07cd020ff9b
- SHA1 46b8332774561f3bd4e78f7d000c4ad818b72e55
- SHA512 9dbf242d6a8f6fb87e33b982d390a9a505101be0dcb52ba3073fce92cb39afb2423b57a9239a02648d0a743f1f4e96600fdf8f7e71ad055cdf1ad796faf87713
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
PI6354.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.lonxer.com/hgn/
-
chaskalocalseo.com
-
grandmaxwell.win
-
aspire-perspire.win
-
jeromesamuel.com
-
kcaslaboratories.info
-
56ms.net
-
earth-workz.com
-
theproperdogpv.info
-
six4win.net
-
moda.photography
-
unelma.ventures
-
sarahjrbelanger.com
-
harryloveii.com
-
nationalgeo.online
-
webuycarsalgarve.com
-
xvitaxd.com
-
foodrollers.com
-
7leju.com
-
shopbeautify.net
-
hyundaihochiminh.com
-
cybertraining.media
-
natureworldgear.com
-
zhonghe110.com
-
vietman.net
-
apple-reovery-account.com
-
potentfolk.com
-
johnsbirdhouses.com
-
correoscash.info
-
criadordalmatas.com
-
whattabizsolutions.com
-
planka.biz
-
hellfire.online
-
chinawwht.com
-
match-esute.com
-
hollysaidyestocaleb.com
-
jsdezhen.com
-
ournylon.com
-
ape168.com
-
newmediaclub.com
-
claire-tips-blog.com
-
miboutiqueparatuprincesita.com
-
bayareacreditunion.com
-
musedlevelopments.com
-
oplungoppo.net
-
creer1siteinternet.com
-
sellerdekho.com
-
muaxbeautyshop.com
-
ruthiesblend.com
-
scesydneysoilsolutions.com
-
thephillyflowershow.com
-
garantisubemiz.com
-
buildmybike.store
-
electoutsiders.com
-
qoirfsn.com
-
nbautodoor.com
-
jlgaminggear.com
-
purchase-apple9.com
-
sheshowhe.com
-
wasabipanic.com
-
1coinmerchant.com
-
tepinbuy.com
-
zhaojitifang.com
-
ms1166.com
-
lateholiday-deals.com
Targets
-
- Target PI6354.exe
- Size 562KB
- SHA256 9ddbf1453097473cfa4eb4c1a28a6f4a2ecdac3b24179e6fd88d3444bf96ec23
- MD5 e865f64e36ea59737f07f07cd020ff9b
- SHA1 46b8332774561f3bd4e78f7d000c4ad818b72e55
- SHA512 9dbf242d6a8f6fb87e33b982d390a9a505101be0dcb52ba3073fce92cb39afb2423b57a9239a02648d0a743f1f4e96600fdf8f7e71ad055cdf1ad796faf87713
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext