General
- Target 3BJGa7Xw4ugPpll.exe
- Size 990KB
- Sample201012-485rhgmfx6
- SHA256 f397c24f2c684fdcd51dc9954c641d013437a78e24a5cf8c8778196a66a60372
- MD5 bd4c60a45729a5f4a89191a3923b4c4a
- SHA1 937ca3b95b34fe4c85664218cc7ba23c5a306376
- SHA512 e02f9bcd618dee8efce714a6ce01ea5c09d400ca793bb3c2b6dbdc02ec91c231911365079cf9d1100132606b3fd07b3bc078e665138fb5621d4a0ae13764ae2d
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
3BJGa7Xw4ugPpll.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.trusted-inspections.com/k8b/
-
lulubellsgraphicsanddesigns.com
-
metyx.info
-
www423337.com
-
stayliveclothing.com
-
daluotech.com
-
thetruthpublished.com
-
pqlzlnwpz.icu
-
bilginhayvancilik.com
-
ismartdvr.com
-
currenibtc.com
-
dalesj.com
-
restaurantlemontblanc.com
-
lunarstores.com
-
pho-huy.com
-
liquidhardrive.com
-
bcheaplivebuy.com
-
evisaagency.com
-
houstonemergencycenter.com
-
alioverstreet.com
-
nutrhyp.com
-
fzwsnrbzw.icu
-
shesoo.com
-
xn--meditaoevida-7bb9c.com
-
hayatveren-world.com
-
thegamergang.com
-
dayforum.com
-
teamhoodied.com
-
weightm-llc.com
-
synertry.net
-
mariaclarahairstudio.com
-
smartnomic.com
-
seaecstasy.com
-
bestourway.com
-
liferiskmanager.com
-
myeducationnoodle.com
-
cooklikeaspanish.com
-
apacheboatsstory.com
-
688009.xyz
-
even-hand.com
-
therussellpinto.com
-
browedandbare.com
-
hblajiche.com
-
bodygoalsspa.com
-
adeedyworld.com
-
daddydomsme.com
-
webioff.com
-
respec-d.com
-
bitches4studs.com
-
shorasmedan.com
-
mjzmusicphotography.com
-
govild.com
-
luckyfoodexpress.com
-
camouflagedbeauty.com
-
contaclessfundraising.com
-
sencmil.info
-
highwaistedskirts.com
-
alanppafcommodities.com
-
findingthefaceofgod.com
-
peiqizn.com
-
fallgays-mobile.com
-
goudengoed.com
-
shisang.xyz
-
akenco-pharma.com
-
fishingtournament.website
Targets
-
- Target 3BJGa7Xw4ugPpll.exe
- Size 990KB
- SHA256 f397c24f2c684fdcd51dc9954c641d013437a78e24a5cf8c8778196a66a60372
- MD5 bd4c60a45729a5f4a89191a3923b4c4a
- SHA1 937ca3b95b34fe4c85664218cc7ba23c5a306376
- SHA512 e02f9bcd618dee8efce714a6ce01ea5c09d400ca793bb3c2b6dbdc02ec91c231911365079cf9d1100132606b3fd07b3bc078e665138fb5621d4a0ae13764ae2d
- MD5 SHA1 SHA512
-
Formbook Payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext