General
- Target 97bfeff0f03f6d6cc84cccb087f2fef805c6d8c55693a19d43b8ae74702a32ef
- Size 1.1MB
- Sample201106-grfdtmr142
- SHA256 97bfeff0f03f6d6cc84cccb087f2fef805c6d8c55693a19d43b8ae74702a32ef
- MD5 453727cd87072cbb99031f6a41b1895c
- SHA1 7ad7fedb38ae5102e01f2e4244f3928937f95d97
- SHA512 d5f8ec261d2a823273fcb2be7f1378712a9fad8c881293275ed52f331e7860a488b98110b87dd7d172458dc04f2d0a1376a920dd0fb3f8cadf5afc9ba48a552d
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
97bfeff0f03f6d6cc84cccb087f2fef805c6d8c55693a19d43b8ae74702a32ef.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.bottrader.digital/d8h/
-
citizen10.com
-
shalynmusic.com
-
jerseycoastcollectibles.com
-
ilginozgul.academy
-
meralbilkay.com
-
sparkasse-suedpfalz.net
-
blackbeltbeef.farm
-
careermoatsbook.com
-
angiesaludable.com
-
9y9y9.xyz
-
freyafallen.com
-
cbluebelt3dwdbuy.com
-
steeltownlabs.com
-
maskupforschool.com
-
unicornnotary.com
-
erometa.com
-
albumofindia.online
-
danhuman.com
-
denizlidekep.com
-
kenna.foundation
-
phone-avail18.club
-
kanbachi.com
-
oahmxiakia5.com
-
erpsystem.site
-
magentnew.com
-
wesportscity.com
-
theclubibiza.com
-
pidoo.pet
-
treehaire.com
-
moto-sure.com
-
konsultanjasa.com
-
nvschoolology.com
-
bohecdk.net
-
fieldstoneweb.com
-
vivatecworld.com
-
locobugs.com
-
ubestedu.com
-
aioffice.net
-
chaoscraftsonthesidellc.com
-
hiddenhillsgems.com
-
ececircuit.com
-
anaejoao2021.com
-
igensheets.com
-
winemakingkit.net
-
toplegallawfirm.com
-
talayer.com
-
keepamericansgreatagain.com
-
hendieboards.com
-
interaction-logistics.com
-
shpanyang.com
-
cooslickgin.com
-
circuswiththestars.com
-
couple.chat
-
officialvantop.com
-
eaeqc.com
-
matu-edu.com
-
theseeingglass.com
-
winkwinx.com
-
5661933.com
-
sbsx.online
-
happysnackbaggin.com
-
piscanc.net
-
griffinmcshane.com
-
elvinejacketsonline.com
Targets
-
- Target 97bfeff0f03f6d6cc84cccb087f2fef805c6d8c55693a19d43b8ae74702a32ef
- Size 1.1MB
- SHA256 97bfeff0f03f6d6cc84cccb087f2fef805c6d8c55693a19d43b8ae74702a32ef
- MD5 453727cd87072cbb99031f6a41b1895c
- SHA1 7ad7fedb38ae5102e01f2e4244f3928937f95d97
- SHA512 d5f8ec261d2a823273fcb2be7f1378712a9fad8c881293275ed52f331e7860a488b98110b87dd7d172458dc04f2d0a1376a920dd0fb3f8cadf5afc9ba48a552d
- MD5 SHA1 SHA512
-
Formbook Payload
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext