General
- Target m1FW0cryNz0hRX3.exe
- Size 501KB
- Sample201020-45ccepdsra
- SHA256 0bfa5712201676e9439c4624fd99b8ec2bba95ccd53fb67f0a289b0a8347fc7c
- MD5 2b06d0fd8922ce9734a5ffc0caf86f5b
- SHA1 517325e338b259bb1528b6d1d8394e9514a0f4f5
- SHA512 96353246a88c1875a54e38ddb749d40ab82df79f68a643fa7acced8c9f49f04fb4382bf6ffa0e3b19e2dd6f6981965ea1e42a303093129f688ac7a4010056665
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
m1FW0cryNz0hRX3.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.bfboke.com/cpi/
-
tw2dl.com
-
cdmingjun.com
-
tamquin.net
-
shipu252.com
-
teamxnd02.com
-
finansi.website
-
datainnbooking.com
-
shannonballcoach.com
-
giaoruou.club
-
tierraycielo.com
-
quizfall.info
-
hallwayworker.guru
-
smartfundoptions.com
-
iishon11.com
-
zzg-wj7k9.net
-
mylinkbio.com
-
xn--kzw5tq0of14b.com
-
coursereel.club
-
koalainsulationinc.com
-
5ljhyr.com
-
mjhex.com
-
tacpa1.com
-
meadowcap.com
-
evalassproductions.com
-
ilybuy.com
-
recetasdecocinax.com
-
taxtechintelligence.com
-
maristafford.com
-
vireiautonomo.com
-
lahorees.com
-
instahawkers.com
-
renewedwomen.net
-
raudlatulmuhibbin.com
-
hotrodport.net
-
virtualensembleproject.com
-
discoverhp.com
-
portalinformasi.com
-
luzyverdadmiami.com
-
kelasonlineindie.site
-
ohmacey.com
-
titancoreholdings.com
-
rudrasilver.com
-
canandavisagovt.com
-
petwaterdispenserstore.com
-
thaluang1607.com
-
mofongovegano.com
-
hansemall.com
-
amesticaenterprises.com
-
bilzy.info
-
lakedip.com
-
perfectohydrodrills.com
-
thegenvalue.com
-
viviandsenaworld.com
-
blackdfw.com
-
801roof.net
-
khungtranh.net
-
gloryofeden.com
-
jennishewardart.com
-
stilesbuildco.com
-
freedomuph.com
-
quafecompany.com
-
ladyofluggage.com
-
casabellatranslations.com
-
nezzet.net
Targets
-
- Target m1FW0cryNz0hRX3.exe
- Size 501KB
- SHA256 0bfa5712201676e9439c4624fd99b8ec2bba95ccd53fb67f0a289b0a8347fc7c
- MD5 2b06d0fd8922ce9734a5ffc0caf86f5b
- SHA1 517325e338b259bb1528b6d1d8394e9514a0f4f5
- SHA512 96353246a88c1875a54e38ddb749d40ab82df79f68a643fa7acced8c9f49f04fb4382bf6ffa0e3b19e2dd6f6981965ea1e42a303093129f688ac7a4010056665
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext