General
- Target zWC6iOTJphZA0sb.exe
- Size 781KB
- Sample201013-48smmsygq2
- SHA256 76e0bf03767dfd6316810d96d2404daf16397a0ef3b90daf96ad67bc461209a8
- MD5 449f902658a40247d149e1f82666701f
- SHA1 ec960c01a39fed146720228f4ad3587bbe0a7f91
- SHA512 e083652fc186653061fc277f8227d68f8ea5cf3eec14d0cf12ef78ba656c93c532b247dae3775de3c39cb7d2ac386360a7b1c277ce2fae6b863a4e6f2095cae8
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
zWC6iOTJphZA0sb.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.trusted-inspections.com/k8b/
-
lulubellsgraphicsanddesigns.com
-
metyx.info
-
www423337.com
-
stayliveclothing.com
-
daluotech.com
-
thetruthpublished.com
-
pqlzlnwpz.icu
-
bilginhayvancilik.com
-
ismartdvr.com
-
currenibtc.com
-
dalesj.com
-
restaurantlemontblanc.com
-
lunarstores.com
-
pho-huy.com
-
liquidhardrive.com
-
bcheaplivebuy.com
-
evisaagency.com
-
houstonemergencycenter.com
-
alioverstreet.com
-
nutrhyp.com
-
fzwsnrbzw.icu
-
shesoo.com
-
xn--meditaoevida-7bb9c.com
-
hayatveren-world.com
-
thegamergang.com
-
dayforum.com
-
teamhoodied.com
-
weightm-llc.com
-
synertry.net
-
mariaclarahairstudio.com
-
smartnomic.com
-
seaecstasy.com
-
bestourway.com
-
liferiskmanager.com
-
myeducationnoodle.com
-
cooklikeaspanish.com
-
apacheboatsstory.com
-
688009.xyz
-
even-hand.com
-
therussellpinto.com
-
browedandbare.com
-
hblajiche.com
-
bodygoalsspa.com
-
adeedyworld.com
-
daddydomsme.com
-
webioff.com
-
respec-d.com
-
bitches4studs.com
-
shorasmedan.com
-
mjzmusicphotography.com
-
govild.com
-
luckyfoodexpress.com
-
camouflagedbeauty.com
-
contaclessfundraising.com
-
sencmil.info
-
highwaistedskirts.com
-
alanppafcommodities.com
-
findingthefaceofgod.com
-
peiqizn.com
-
fallgays-mobile.com
-
goudengoed.com
-
shisang.xyz
-
akenco-pharma.com
-
fishingtournament.website
Targets
-
- Target zWC6iOTJphZA0sb.exe
- Size 781KB
- SHA256 76e0bf03767dfd6316810d96d2404daf16397a0ef3b90daf96ad67bc461209a8
- MD5 449f902658a40247d149e1f82666701f
- SHA1 ec960c01a39fed146720228f4ad3587bbe0a7f91
- SHA512 e083652fc186653061fc277f8227d68f8ea5cf3eec14d0cf12ef78ba656c93c532b247dae3775de3c39cb7d2ac386360a7b1c277ce2fae6b863a4e6f2095cae8
- MD5 SHA1 SHA512
Formbook Payload
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Suspicious use of SetThreadContext