General
- Target ORDER LIST.exe
- Size 579KB
- Sample201109-lnjgpthv3x
- SHA256 c18c5e02d67ca2dea08e13f3731c5dd0f5d8833bf2b606287c97e1d053564b85
- MD5 42487f802a35746bf11d808133837801
- SHA1 593369fa8fac39294cfd6a3e476d4e1ce34ca0b8
- SHA512 ffa1bb4f1566a6412a3e2657a867c1951c440e2dfcb6e857dd5422bc9475fc169801578ab89717e8c143a81362a9461469a0de1c45c270012c58c0bee2c99dba
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
ORDER LIST.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.bottrader.digital/d8h/
-
citizen10.com
-
shalynmusic.com
-
jerseycoastcollectibles.com
-
ilginozgul.academy
-
meralbilkay.com
-
sparkasse-suedpfalz.net
-
blackbeltbeef.farm
-
careermoatsbook.com
-
angiesaludable.com
-
9y9y9.xyz
-
freyafallen.com
-
cbluebelt3dwdbuy.com
-
steeltownlabs.com
-
maskupforschool.com
-
unicornnotary.com
-
erometa.com
-
albumofindia.online
-
danhuman.com
-
denizlidekep.com
-
kenna.foundation
-
phone-avail18.club
-
kanbachi.com
-
oahmxiakia5.com
-
erpsystem.site
-
magentnew.com
-
wesportscity.com
-
theclubibiza.com
-
pidoo.pet
-
treehaire.com
-
moto-sure.com
-
konsultanjasa.com
-
nvschoolology.com
-
bohecdk.net
-
fieldstoneweb.com
-
vivatecworld.com
-
locobugs.com
-
ubestedu.com
-
aioffice.net
-
chaoscraftsonthesidellc.com
-
hiddenhillsgems.com
-
ececircuit.com
-
anaejoao2021.com
-
igensheets.com
-
winemakingkit.net
-
toplegallawfirm.com
-
talayer.com
-
keepamericansgreatagain.com
-
hendieboards.com
-
interaction-logistics.com
-
shpanyang.com
-
cooslickgin.com
-
circuswiththestars.com
-
couple.chat
-
officialvantop.com
-
eaeqc.com
-
matu-edu.com
-
theseeingglass.com
-
winkwinx.com
-
5661933.com
-
sbsx.online
-
happysnackbaggin.com
-
piscanc.net
-
griffinmcshane.com
-
elvinejacketsonline.com
Targets
-
- Target ORDER LIST.exe
- Size 579KB
- SHA256 c18c5e02d67ca2dea08e13f3731c5dd0f5d8833bf2b606287c97e1d053564b85
- MD5 42487f802a35746bf11d808133837801
- SHA1 593369fa8fac39294cfd6a3e476d4e1ce34ca0b8
- SHA512 ffa1bb4f1566a6412a3e2657a867c1951c440e2dfcb6e857dd5422bc9475fc169801578ab89717e8c143a81362a9461469a0de1c45c270012c58c0bee2c99dba
- MD5 SHA1 SHA512
-
Formbook Payload
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext