General
- Target Artha Karya Utama (Aku Food) - Quotation.exe
- Size 1.3MB
- Sample201027-4kglrbdpc2
- SHA256 0375352dd935ee474c225b1e7c35707a10f7100b0167bbabd5a497dbb34777cf
- MD5 a13635c9ec5a70cdf3525312c9b418c6
- SHA1 b8b664a6a7c57db9c28074c6ad9297eb2d2b6479
- SHA512 f0cce13de4ebcad9c18c6c37d386bcae0d8fd904cee8f96602e71f2922858520b647158deab178a966e94a85bb9ed4843744750fbe38a1e01cc54eebe78615b3
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Artha Karya Utama (Aku Food) - Quotation.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.goldenlinkpowerdeals.com/esp5/
-
hydrationgo.com
-
16939meadowcrest.info
-
coopname.com
-
rentaroompattaya.com
-
elena-zabrodina.com
-
veronicaspeaks.net
-
bleeask.com
-
moneytransfergas.com
-
marylandmtb.com
-
pencil-cone.com
-
mypilzer.com
-
seniorngr.com
-
myvcardhub.com
-
uwn5depranium.xyz
-
muddycreekservices.com
-
bodrum-ua.com
-
sfadfdfsdf.club
-
empreendernaweb.net
-
shopwearesdg.com
-
gestiondeproyectoscp6.com
-
bb139b.com
-
earthsidestorey.com
-
rehobthcompany.com
-
properfrench.com
-
hunanmanhe.com
-
melissajstevens.com
-
socialmachina.com
-
sentus.net
-
spherewallet.com
-
zebrafunds.com
-
stylablemention.com
-
uto.xyz
-
amarresysanteriapoderosa.com
-
mp3tonstudio.com
-
sdsolarco.com
-
shinewellnessandabundance.com
-
therockinoaxacan.com
-
saudib.xyz
-
mommymeetups.com
-
calzevanitose.info
-
sale.business
-
globalwelfareoranization.com
-
efficacy-online-shop.com
-
24k88lotto.com
-
omicadvisors.com
-
evrysnorer.com
-
yycqfw.com
-
hotelsandsbay.com
-
thegadpro.com
-
freedompreneur2020.com
-
korsovet.com
-
kuanchengxxg.com
-
motivatecreateyourself.com
-
motowiselogistics.com
-
pamelasoto.com
-
jjautotransinc.net
-
vistaeldercare.com
-
bunnylapin.com
-
brhenson.xyz
-
moonvision3.com
-
tnnovation.com
-
champion.sucks
-
herbalmedicineresearch.com
-
mescladesign.com
Targets
-
- Target Artha Karya Utama (Aku Food) - Quotation.exe
- Size 1.3MB
- SHA256 0375352dd935ee474c225b1e7c35707a10f7100b0167bbabd5a497dbb34777cf
- MD5 a13635c9ec5a70cdf3525312c9b418c6
- SHA1 b8b664a6a7c57db9c28074c6ad9297eb2d2b6479
- SHA512 f0cce13de4ebcad9c18c6c37d386bcae0d8fd904cee8f96602e71f2922858520b647158deab178a966e94a85bb9ed4843744750fbe38a1e01cc54eebe78615b3
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext