General
- Target New Purchase Order 50,689$.exe
- Size 534KB
- Sample201010-4bcp9rs5je
- SHA256 7743197c71f1c9ae348ca9d594840701835941008ea784deef3eec32b3bc734b
- MD5 12992accec225e9f9698c02a93180bf7
- SHA1 f76dc23da1d8ac882edfee4d2f07bb48f00dd17c
- SHA512 825b54d31d52f2681d3b0d965663d657d306a096a26ae0b1da35006e6da8544136227e1e9806efce00b24916879d2ab6eb50f6b0c48a518682fee5ad31146c1f
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
New Purchase Order 50,689$.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.touchtoby.xyz/eao/
-
littletram.com
-
vanmetaal.com
-
clubbingspringbreak.com
-
intohuman.com
-
steph.place
-
ipsumksa.com
-
paultoon.com
-
wocwebowecbweogw.com
-
beverlyhillsmerch.com
-
vans-athens.com
-
stylishnailsbyem.com
-
milletvit.com
-
pappyjacksburgershack.com
-
anal-liza.com
-
lotownerbuilders.com
-
caffinatics.com
-
cvbtrading.co.uk
-
pheasanttrailsgolfcourse.com
-
wed0888.com
-
sundeepm.com
-
moneymakersclub.net
-
candcsaptai.com
-
skogsframjandet.com
-
rockstarpartyrentals.com
-
prostylezhairsalon.com
-
rogue.football
-
selfsufficientlearners.com
-
wisdom-consult.com
-
pivicric.info
-
domainemariage.com
-
mathsforstudents.com
-
wowdaebak.com
-
linbook8888.com
-
exceeidt.com
-
aicebit.com
-
ncgf61.com
-
argenteriamantova.com
-
hey-bamboo.com
-
elgritodeharpo.com
-
realbrosofles.com
-
5766557.com
-
galileomkt.com
-
astrugar.com
-
haasmyasupportagency.com
-
power-realestate.com
-
14201shastaway.com
-
solofsantabarbara.com
-
magentnew.com
-
xuedaiting.com
-
accokeektvmounting.com
-
ressindia.com
-
abuju.com
-
commcheapshop.com
-
indokaryasm.com
-
taddle.one
-
economicdevelopmentsoftware.com
-
fayk222.icu
-
4winner.xyz
-
undefinedheightsinc.com
-
sunfloe.com
-
xp135.com
-
simoncablehair.com
-
condor-protection.com
-
dentoviaoneday.com
Targets
-
- Target New Purchase Order 50,689$.exe
- Size 534KB
- SHA256 7743197c71f1c9ae348ca9d594840701835941008ea784deef3eec32b3bc734b
- MD5 12992accec225e9f9698c02a93180bf7
- SHA1 f76dc23da1d8ac882edfee4d2f07bb48f00dd17c
- SHA512 825b54d31d52f2681d3b0d965663d657d306a096a26ae0b1da35006e6da8544136227e1e9806efce00b24916879d2ab6eb50f6b0c48a518682fee5ad31146c1f
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext