General
- Target ORDER#08182020.exe
- Size 559KB
- Sample200818-y1dq7xtdqa
- SHA256 ec24550a9fa2fdb2a0e7c739b9ac97387925808dbd832b11675f18e48a93bcc5
- MD5 8ef0ae4c150733c32e6ab39bd3e536f6
- SHA1 cb9719eb66ed563bd1c3b7fa7313297b5309bf45
- SHA512 bd07155e91c853460123c86d2996e2538671a630b2b1ab443f8cf73c55517f2d4e7693880bffa10d6ef336d1b650bfb3139a2173c3dc170ce0c17cfea3d7d358
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
ORDER#08182020.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.regulars6.com/zaer/
-
lipbombed.com
-
abmeadors-insurance.biz
-
devtechsolar.com
-
austin-roofingcontractor.com
-
makavelioffspring.com
-
sredalab.com
-
attractionvideo.com
-
designmouldingterrain.com
-
nicerecipes15.info
-
gdclosalcores.com
-
jesussaysyesorno.online
-
forpleasantsleep.com
-
cynthiascountrystore.com
-
thedisinsiderbeta.com
-
dushixue.com
-
eveitis.com
-
huyue-jixie.com
-
buoyantcoin.com
-
london-security-shutters.com
-
fokusworld.com
-
teleclara.com
-
songlyricssearchengine.online
-
asiapremierdev.com
-
hbhjcf.com
-
jany2009.com
-
avdol.com
-
busrauyar.com
-
bfuee.info
-
abujalfa.com
-
storagearchivequick.win
-
unotoe.com
-
themedianewsroom.com
-
lifehackvideos.com
-
mailwizz.online
-
recuerdosmemorables.com
-
hi-digiq.com
-
cru.email
-
formations.house
-
1024eeef.info
-
candsmoguls.info
-
upstreetbrands.com
-
nohy-su-sexy.com
-
aryu.ltd
-
intratri.info
-
paragnishar.com
-
ngnmx.top
-
booksforgeeks.com
-
bjgsbg64.com
-
brokoff.com
-
68882k.com
-
ineedhelprepairingmycredit.info
-
electricblankets.online
-
aporadhbarta.net
-
thomasmyeong.com
-
translationsabc.net
-
howshot.net
-
drsexo.com
-
umconnectumcsn.com
-
sinamashini.com
-
0n4ninemega.men
-
juzi-it.com
-
apclo.net
-
511xx.com
-
vpmeat.wales
Targets
-
- Target ORDER#08182020.exe
- Size 559KB
- SHA256 ec24550a9fa2fdb2a0e7c739b9ac97387925808dbd832b11675f18e48a93bcc5
- MD5 8ef0ae4c150733c32e6ab39bd3e536f6
- SHA1 cb9719eb66ed563bd1c3b7fa7313297b5309bf45
- SHA512 bd07155e91c853460123c86d2996e2538671a630b2b1ab443f8cf73c55517f2d4e7693880bffa10d6ef336d1b650bfb3139a2173c3dc170ce0c17cfea3d7d358
- MD5 SHA1 SHA512
-
Formbook Payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext