General
- Target new requests.exe
- Size 738KB
- Sample201105-herycs2mn6
- SHA256 106bfa0280569ce313c19beb1c68515fb148212a033fdd96ef075d38256f5fb9
- MD5 119b0d745094dfebe724835403035125
- SHA1 54406830ee2ab1ea067bc065a4973e649a9d4dfa
- SHA512 9a9cd24ce6da5beb7f1e00b091506ec3db6d98f384234dd986653435a3d944ec12299f2d8c09c66e3a6e4018b886d1903dec556bcb4985fa089592ff12ff96b5
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
new requests.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.thehappyhourtimes.com/z0po/
-
trouverunartisanserieux.com
-
dawn-niece.xyz
-
smalltree2021.com
-
asiansforliberty.com
-
suyeaimwnd.com
-
67630pp.com
-
drinkdeliveryservices.com
-
icollect-auctions.com
-
transformintecture.com
-
systemaircn.com
-
bluemonkeyhealingenergy.com
-
joebartonproducts.com
-
sacredclouddesigns.com
-
discovertravelco.com
-
haxb33.xyz
-
soldadorprofissional.com
-
disruptergen.com
-
senvias12.com
-
culinaryrambler.net
-
hnhlsm.com
-
mfgwhere.com
-
nongtraixanh.xyz
-
na-mangalle.store
-
luxecoffeeco.net
-
scbtzbayk.icu
-
wealthprotein.com
-
heritagehardwoodsri.com
-
moorreal.com
-
roofingsantamonica.com
-
pinkpigprint.design
-
carlam.cymru
-
top10bestblogsites.com
-
xbs306.com
-
emmasconfections.com
-
pepperhaul.com
-
crowleyvos.com
-
czshht.com
-
koemcom.com
-
themlhub.com
-
4laborday.com
-
laarastore.com
-
integrityglobalacademy.com
-
per-reco.net
-
liste365.com
-
layjzsjt.com
-
gardenoffear.com
-
greenhouse2011.com
-
anthonyfung.com
-
kkkdaily.com
-
la2enjoy.com
-
uniquegranitebenefits.com
-
service-dehxsndts.com
-
kamilcoway.com
-
oetbug.xyz
-
bitclubcapitol.com
-
usaclisurvival.com
-
schemeandsmash.com
-
cuacuoncuakeorachgia.com
-
bringourtroopshome.info
-
epitomelab.com
-
academianeurosapiens.com
-
ahxbqp.com
-
rv-uni.com
-
emilyhopecollection.com
Targets
-
- Target new requests.exe
- Size 738KB
- SHA256 106bfa0280569ce313c19beb1c68515fb148212a033fdd96ef075d38256f5fb9
- MD5 119b0d745094dfebe724835403035125
- SHA1 54406830ee2ab1ea067bc065a4973e649a9d4dfa
- SHA512 9a9cd24ce6da5beb7f1e00b091506ec3db6d98f384234dd986653435a3d944ec12299f2d8c09c66e3a6e4018b886d1903dec556bcb4985fa089592ff12ff96b5
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext