General
- Target REQUEST FOR QUOTE.exe
- Size 1015KB
- Sample201020-812fcaf7ts
- SHA256 1d6b4c596e189a78ffd872bffe908aaf27f74f6c36dddfd50b517f9155c0938b
- MD5 c64e0bcdf069ee5c60cfbea8f3526079
- SHA1 e992d7e3d6056915d9a4cc495073a23b4433e92b
- SHA512 87b09c7dfbf20950ed874d0e89671e78ada892ea1ac6bdbd7ec7ed66425fd7a9d87b33e520123877e56db88b1c535cb7cf63a6249c4850d08622748c4ee58626
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
REQUEST FOR QUOTE.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.bringkyliehome.com/emh/
-
nispvisaservice.com
-
nikhigiovani.com
-
weddingmotions.com
-
villaorhome.com
-
tikigolf3d.com
-
mndesignw.com
-
jeeugae.com
-
xn--80ayhfu4d.xn--80asehdb
-
alpinefall.com
-
circespa.com
-
digiqsalon.com
-
kangzhanxian.com
-
fourleaftextiles.com
-
inclusivehealthresearch.com
-
zhongruiyintai.com
-
xobowoa.space
-
tiantipaihangbang.com
-
friendsofricoelmore.net
-
abalto.xyz
-
elisautodetailingllc.com
-
rodronbein.com
-
grabngogranny.com
-
manage-funds.com
-
ziyong9.xyz
-
positivelycosy.com
-
freetimecleaningservices.com
-
billpollakwritingandediting.com
-
mastjio.com
-
thelittleredcraftshack.com
-
lawyeronlineacademy.com
-
mgameinfo.com
-
espacoweb.com
-
moccustoms.com
-
freecatsociety.com
-
elsie24gourmetgrill.com
-
exyron.xyz
-
thedreamsachievers.com
-
marieriksmoen.com
-
hamarazayaka.com
-
mentatrain.info
-
odorfood.com
-
cinargenerator.com
-
matsubokkuri-huhu.com
-
responsible.academy
-
workspacefor1.com
-
ukchealth.com
-
edgecomput.info
-
serialphilanthropy.com
-
uptown-accounting.com
-
computers-atlanta.com
-
digitplusone.store
-
gardencontainerbar.com
-
betteringthehumanexperience.xyz
-
wxxxtw.com
-
yuanerkang.club
-
meditec-s.com
-
ahazaneim.com
-
missunderstoodclothing.com
-
lavenderfarmsboutique.com
-
aminamaroc.com
-
covaana.com
-
cutaboveonline.com
-
healthcarereservists.com
-
mariannehoefer-krey.com
Targets
-
- Target REQUEST FOR QUOTE.exe
- Size 1015KB
- SHA256 1d6b4c596e189a78ffd872bffe908aaf27f74f6c36dddfd50b517f9155c0938b
- MD5 c64e0bcdf069ee5c60cfbea8f3526079
- SHA1 e992d7e3d6056915d9a4cc495073a23b4433e92b
- SHA512 87b09c7dfbf20950ed874d0e89671e78ada892ea1ac6bdbd7ec7ed66425fd7a9d87b33e520123877e56db88b1c535cb7cf63a6249c4850d08622748c4ee58626
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext