General
- Target Inquiry.exe.exe
- Size 395KB
- Sample201109-vcphv53p9n
- SHA256 df2bbdd833be8896f46c8660acfc9da2711f2a75d8338240b781fc6ee3964f9e
- MD5 f5200d15a07bcc43ca60af2aa0052bd8
- SHA1 139eeca2b690d57727baff58c7ca8a482f9b8ca6
- SHA512 21c39125f9e12821f11ff10ebc3d53cf5d788459cd10125d99aec36aaaaa2901c31fef5fd60a006858393ef08df0d90a0c546c45e9af604f85025ebbd77d4b2f
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry.exe.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.joomlas123.com/4vx/
-
kontinuer.com
-
outofthebluelove.com
-
docentrood.com
-
emowm.com
-
jsa862.net
-
kshoworld.com
-
kumsalkorel.com
-
adrigh.info
-
goldentrianglerv.com
-
youkuy.com
-
lindaclijsters.com
-
audreyfarley.com
-
alasitter.com
-
uscar-boerse.com
-
successwithfletch.com
-
474opebet.com
-
xjlfb.com
-
doingworkabroad.com
-
0pe864.com
-
ittestperfumeok.live
-
newfaith-ministries.com
-
longfellowpurebreds.com
-
aeroclubcrema.com
-
lifehandson.com
-
diamond-distinction.com
-
miaowbid.info
-
chicagorefinanceblog.com
-
news3033.com
-
jllsjl.com
-
tianshidaxue.com
-
wenbuwen.com
-
helpme.science
-
manulifeindonesia.online
-
407motorcars.com
-
tuneinchannel.com
-
chrisbuie.com
-
e-karta.online
-
haohuofenxiang.com
-
boav75.com
-
dovu.ltd
-
countryhomecityhome.com
-
klmloanservicing.com
-
jwxqfx.info
-
allaboutrosalilla.com
-
550315.top
-
giuongnguxuatkhau.com
-
ambassystyle.com
-
someron.com
-
ghplhose.com
-
blogwithapurpose.com
-
spermbank.men
-
taveon.com
-
danceyourability.com
-
chuangxingcn.com
-
ksvvu.win
-
xn--6cs32cp56d.com
-
tediapowell.com
-
avayqk.info
-
promotemeentertainment.com
-
tuhfa-gallery.com
-
superyachtprojectmanager.com
-
leisterheating.com
-
themercantileshop.com
-
youpinyoufu.com
Targets
-
- Target Inquiry.exe.exe
- Size 395KB
- SHA256 df2bbdd833be8896f46c8660acfc9da2711f2a75d8338240b781fc6ee3964f9e
- MD5 f5200d15a07bcc43ca60af2aa0052bd8
- SHA1 139eeca2b690d57727baff58c7ca8a482f9b8ca6
- SHA512 21c39125f9e12821f11ff10ebc3d53cf5d788459cd10125d99aec36aaaaa2901c31fef5fd60a006858393ef08df0d90a0c546c45e9af604f85025ebbd77d4b2f
- MD5 SHA1 SHA512
Formbook Payload
Deletes itself
Suspicious use of SetThreadContext