General
- Target po.no.4414463099.exe
- Size 623KB
- Sample201016-ndezhb4pxj
- SHA256 201e2fd48dfdd75ee8abf1ad910deb3ffa1784ae0229fe7588b2b54119409aee
- MD5 628b560274bb0807824cb9b06a8d669a
- SHA1 887600f411d15a4e53b69b0c857057cb918ab284
- SHA512 cc52210772ef7c5389bd785b5f66493d0c54945161780d20a17d483022b117da9191d1b94cc293e7434c7d877eff52252c0e750008978194b00a2ec4e899e2c3
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
po.no.4414463099.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.jsbdistributor.com/u2e/
-
aartihand.com
-
texasreloaded.com
-
2794moraga.com
-
mybcinfo.com
-
wriz.xyz
-
headlundco.com
-
officialangelanichelle.com
-
danielledelaine.com
-
ateliermalibu.com
-
vantaimanhtruong.com
-
zhimazhiyun.com
-
saimeeraservices.com
-
baisongke.com
-
catearhelmet.com
-
palasian.net
-
merchantofzanzibar.com
-
ateliercrepin.com
-
guardtactics.com
-
ceritadata.com
-
nacesiti.com
-
pinacle.online
-
sosgov.com
-
batchjoy.com
-
arosevirtualassistant.com
-
xn--razfashion-l8a.com
-
worstcasebestcase.com
-
lemengkj.com
-
rekill.space
-
kumpanews.com
-
6936399.com
-
theselfunknown.com
-
jenniferlwilsonrn.com
-
thefeesimple.com
-
my500now1.club
-
goflexcolors.com
-
moneysavingexpertmonarch.xyz
-
notaria8colima.com
-
mtourlo.com
-
pomp.coffee
-
colettesimonepsyd.com
-
videocoachforbusiness.com
-
samograd.online
-
sustainableminimalistyoga.com
-
charactermovement.net
-
ahyqmux.icu
-
severbroke.com
-
impresos25.com
-
detroitswingcompany.com
-
onehealthtaskforce.com
-
adesignmuseum.net
-
roguesummers.net
-
stephaniebauer.net
-
kommodore.online
-
daveadonai.com
-
a-great-homegym.fyi
-
duwegawe.com
-
bukannyaterbuai34.com
-
murphyconstructiongunnison.com
-
peacelovez.com
-
saleselgaucho.com
-
ahrmj.com
-
quickprepandship.com
-
t4pacademy.com
-
themarketingrecipes.com
Targets
-
- Target po.no.4414463099.exe
- Size 623KB
- SHA256 201e2fd48dfdd75ee8abf1ad910deb3ffa1784ae0229fe7588b2b54119409aee
- MD5 628b560274bb0807824cb9b06a8d669a
- SHA1 887600f411d15a4e53b69b0c857057cb918ab284
- SHA512 cc52210772ef7c5389bd785b5f66493d0c54945161780d20a17d483022b117da9191d1b94cc293e7434c7d877eff52252c0e750008978194b00a2ec4e899e2c3
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext