General
- Target k7j7Sua3JrEZNPR.exe
- Size 630KB
- Sample201009-r83jsv41ke
- SHA256 f4854fb409d136b74193144c50c888b36bbbbcde71b52acb5f8177a862ebd76c
- MD5 80338c0fd0b356384c5c238cd0167aa6
- SHA1 be0ccb384d79527d6861dc4999e8bea2197a368d
- SHA512 c5bd9e0d2a00fc59e7db5a753a67bd029374561080fc8b587ef284da03a5cf4f8090ffe0f43e2dda275841018833f6c3baf112dffa0cdbba6000fbba0e419029
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
k7j7Sua3JrEZNPR.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.trusted-inspections.com/k8b/
-
lulubellsgraphicsanddesigns.com
-
metyx.info
-
www423337.com
-
stayliveclothing.com
-
daluotech.com
-
thetruthpublished.com
-
pqlzlnwpz.icu
-
bilginhayvancilik.com
-
ismartdvr.com
-
currenibtc.com
-
dalesj.com
-
restaurantlemontblanc.com
-
lunarstores.com
-
pho-huy.com
-
liquidhardrive.com
-
bcheaplivebuy.com
-
evisaagency.com
-
houstonemergencycenter.com
-
alioverstreet.com
-
nutrhyp.com
-
fzwsnrbzw.icu
-
shesoo.com
-
xn--meditaoevida-7bb9c.com
-
hayatveren-world.com
-
thegamergang.com
-
dayforum.com
-
teamhoodied.com
-
weightm-llc.com
-
synertry.net
-
mariaclarahairstudio.com
-
smartnomic.com
-
seaecstasy.com
-
bestourway.com
-
liferiskmanager.com
-
myeducationnoodle.com
-
cooklikeaspanish.com
-
apacheboatsstory.com
-
688009.xyz
-
even-hand.com
-
therussellpinto.com
-
browedandbare.com
-
hblajiche.com
-
bodygoalsspa.com
-
adeedyworld.com
-
daddydomsme.com
-
webioff.com
-
respec-d.com
-
bitches4studs.com
-
shorasmedan.com
-
mjzmusicphotography.com
-
govild.com
-
luckyfoodexpress.com
-
camouflagedbeauty.com
-
contaclessfundraising.com
-
sencmil.info
-
highwaistedskirts.com
-
alanppafcommodities.com
-
findingthefaceofgod.com
-
peiqizn.com
-
fallgays-mobile.com
-
goudengoed.com
-
shisang.xyz
-
akenco-pharma.com
-
fishingtournament.website
Targets
-
- Target k7j7Sua3JrEZNPR.exe
- Size 630KB
- SHA256 f4854fb409d136b74193144c50c888b36bbbbcde71b52acb5f8177a862ebd76c
- MD5 80338c0fd0b356384c5c238cd0167aa6
- SHA1 be0ccb384d79527d6861dc4999e8bea2197a368d
- SHA512 c5bd9e0d2a00fc59e7db5a753a67bd029374561080fc8b587ef284da03a5cf4f8090ffe0f43e2dda275841018833f6c3baf112dffa0cdbba6000fbba0e419029
- MD5 SHA1 SHA512
-
Formbook Payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext