General
- Target p5QtI97P3kMxZO4.exe
- Size 864KB
- Sample201010-43x3fl32zn
- SHA256 db53a27c43dddb419e9d058e6288f3c1e7fc7e4bd62e3bb048e7103dcf79d682
- MD5 a1f535aad70c6411bd8e9b2adceb08d6
- SHA1 aea1fab34741f88b40a605c4e021039af8d255e9
- SHA512 d8f6f613b1aab819220ee854c3209404c477178d0927604b9463fc90770df614374fc440827cf5205056419a6b7ba4a41a6097bce701c2d2532d976f5befef16
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
p5QtI97P3kMxZO4.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.trusted-inspections.com/k8b/
-
lulubellsgraphicsanddesigns.com
-
metyx.info
-
www423337.com
-
stayliveclothing.com
-
daluotech.com
-
thetruthpublished.com
-
pqlzlnwpz.icu
-
bilginhayvancilik.com
-
ismartdvr.com
-
currenibtc.com
-
dalesj.com
-
restaurantlemontblanc.com
-
lunarstores.com
-
pho-huy.com
-
liquidhardrive.com
-
bcheaplivebuy.com
-
evisaagency.com
-
houstonemergencycenter.com
-
alioverstreet.com
-
nutrhyp.com
-
fzwsnrbzw.icu
-
shesoo.com
-
xn--meditaoevida-7bb9c.com
-
hayatveren-world.com
-
thegamergang.com
-
dayforum.com
-
teamhoodied.com
-
weightm-llc.com
-
synertry.net
-
mariaclarahairstudio.com
-
smartnomic.com
-
seaecstasy.com
-
bestourway.com
-
liferiskmanager.com
-
myeducationnoodle.com
-
cooklikeaspanish.com
-
apacheboatsstory.com
-
688009.xyz
-
even-hand.com
-
therussellpinto.com
-
browedandbare.com
-
hblajiche.com
-
bodygoalsspa.com
-
adeedyworld.com
-
daddydomsme.com
-
webioff.com
-
respec-d.com
-
bitches4studs.com
-
shorasmedan.com
-
mjzmusicphotography.com
-
govild.com
-
luckyfoodexpress.com
-
camouflagedbeauty.com
-
contaclessfundraising.com
-
sencmil.info
-
highwaistedskirts.com
-
alanppafcommodities.com
-
findingthefaceofgod.com
-
peiqizn.com
-
fallgays-mobile.com
-
goudengoed.com
-
shisang.xyz
-
akenco-pharma.com
-
fishingtournament.website
Targets
-
- Target p5QtI97P3kMxZO4.exe
- Size 864KB
- SHA256 db53a27c43dddb419e9d058e6288f3c1e7fc7e4bd62e3bb048e7103dcf79d682
- MD5 a1f535aad70c6411bd8e9b2adceb08d6
- SHA1 aea1fab34741f88b40a605c4e021039af8d255e9
- SHA512 d8f6f613b1aab819220ee854c3209404c477178d0927604b9463fc90770df614374fc440827cf5205056419a6b7ba4a41a6097bce701c2d2532d976f5befef16
- MD5 SHA1 SHA512
-
Formbook Payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext