General
- Target file.xe
- Size 751KB
- Sample201015-7rwaq3vr2s
- SHA256 0c3afc73b1560d5d817104a616325e9f7a825e6b0158dfa0469b423c8bfbdf64
- MD5 93870a49842c35774a5f3ad061d7c6a2
- SHA1 9e98c235420afa19058917cf0c6d754ac0f7cdbb
- SHA512 a47736ebc85beed6b8aae2706a1d629fb1512dc33d58a1991d243a7ae02e6f2ab7c3881154ef1f465e0ed169781f50cc63b8492eed098848e1378ea34f9b3132
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
file.xe.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.mxmsportsgear.com/dfr/
-
sizcabs.com
-
neochempharma.com
-
femuewedrewa.com
-
sedeot.com
-
dstresscafe.com
-
anthemation.com
-
starcmantova.com
-
brainstore1.com
-
karishara.com
-
amelclothing.com
-
shopmarielcosmetics.com
-
shreejeematrimonial.com
-
maggiesurbanfarm.com
-
backmyplay.com
-
taootop.com
-
riad-libitibito.com
-
nandemo-system.com
-
fastpeoesearch.com
-
thekasharab.com
-
8hapi.com
-
jollypill.com
-
anybodhiyoga.com
-
vrikshamshoponline.com
-
collegeprepbosses.com
-
ajaxhvac.net
-
freethinkingworrior.com
-
shesaprepper.com
-
ctplexiclass.com
-
mhabrewer.com
-
yourlocalaircareservices.com
-
qglygl.com
-
soperlz.xyz
-
doctorelectrical.com
-
teecko.com
-
telquelles.com
-
bestgolfbrands.com
-
ianandalexa.com
-
hibernaltactical.com
-
kittystrand.store
-
pldropshipping.com
-
the-tenth.com
-
kimberlybush-art.com
-
actubonplan.com
-
chasingscratchgolf.com
-
12marki.site
-
ufaoff.com
-
regularity-adonize.info
-
organiclivesoil.com
-
thelondoncandleclub.com
-
chapmangrillz.com
-
hardlyable.com
-
cbluebay3dmall.com
-
votreconseillerassurance.com
-
airliquyde.com
-
bcx66.com
-
cngneng.com
-
gold-retriever.com
-
curaterva.com
-
electricvehiclesdetroit.com
-
dongranjack.com
-
pokemonbot.com
-
geeksfornews.com
-
ilcampervino.com
-
andrewrclark.com
Targets
-
- Target file.xe
- Size 751KB
- SHA256 0c3afc73b1560d5d817104a616325e9f7a825e6b0158dfa0469b423c8bfbdf64
- MD5 93870a49842c35774a5f3ad061d7c6a2
- SHA1 9e98c235420afa19058917cf0c6d754ac0f7cdbb
- SHA512 a47736ebc85beed6b8aae2706a1d629fb1512dc33d58a1991d243a7ae02e6f2ab7c3881154ef1f465e0ed169781f50cc63b8492eed098848e1378ea34f9b3132
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext