General
- Target Approved Customize design.exe
- Size 616KB
- Sample201015-ykkvb5tgg6
- SHA256 4368bd3df923b59ec3239a36cfd6cbd4c8aa568ebfaec16433e0a464d368f362
- MD5 122eb4023cec1548b46222e491ecc83d
- SHA1 b14603e68330f957f2b2df3be4299086a6925bc6
- SHA512 1989594d10db65dea8dba84f9a21beac0339b276c94bdd5b81cb40a0abc1dec09adf9e276b60eca77e4bb73d5ddc52d49a688c7a59553098db7846b66deb8f5e
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Approved Customize design.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.ingfathailand.com/rsu/
-
thecrestdallas.com
-
letsbookt.com
-
cyrobio.com
-
gowithmizan.com
-
ekadamy.com
-
hereforassist.com
-
yogacourse.company
-
bookmostlikely.com
-
seasythings.com
-
yourazre.com
-
iconic-ut.com
-
quantemtips.com
-
dtjgxxw.com
-
adagamov.com
-
7stepsmeal.com
-
iamnicoleschoen.com
-
410advisory.com
-
17aia.com
-
eizousai.net
-
oceanbluecandy.com
-
pictureperfectsmiless.com
-
necght.xyz
-
submitapressrelease.com
-
digitaldynamicss.com
-
puglis.com
-
soysout.com
-
morganhiggins.com
-
johnathancreekdoodles.com
-
loveme-everyday.site
-
natalnoticia.com
-
boffoluxe.com
-
tytnework.com
-
youquan365.com
-
sarakiani.art
-
luxurybaliweddings.com
-
2138palm.com
-
beerdome-basel.com
-
20artattack.com
-
danriveroutfitterslodge.net
-
crossoverimmigrations.com
-
theslicemart.com
-
certifiedcollisionhonda.com
-
freecovidshots.com
-
eledtrik.com
-
saude-emagrecimento.com
-
tightbass.net
-
brewed.info
-
3401arapahoeave.com
-
ibagames.com
-
marketingconquerors.com
-
grialleset.com
-
dudestfu.com
-
yembomarket.com
-
cuxly.com
-
orlandoelevators.com
-
pubgmspinreward.com
-
halalnoidasda.club
-
x11980.com
-
krapkowice.info
-
potercctv.com
-
personaltrainersjc.com
-
istampamou.com
-
onesite.host
-
raben-p.site
Targets
-
- Target Approved Customize design.exe
- Size 616KB
- SHA256 4368bd3df923b59ec3239a36cfd6cbd4c8aa568ebfaec16433e0a464d368f362
- MD5 122eb4023cec1548b46222e491ecc83d
- SHA1 b14603e68330f957f2b2df3be4299086a6925bc6
- SHA512 1989594d10db65dea8dba84f9a21beac0339b276c94bdd5b81cb40a0abc1dec09adf9e276b60eca77e4bb73d5ddc52d49a688c7a59553098db7846b66deb8f5e
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext