General
-
Target
RFQ-MNAMR-001RB-WhastsAAp Images.exe
-
Size
398KB
-
Sample
201109-zlwl2h9yn2
-
MD5
239efcf744fc1e906b704d4eebe4a962
-
SHA1
c8c0fe13941c237cd72c2eb3adcfc13f9513d32d
-
SHA256
aae9b362789cdf8a185d9b963cb3b0ba5d7f5599285cecd8625944168232c42c
-
SHA512
affe8bdcfbdc3e2554f2b8c887a9d417a69b5e031f7433ecf8971cc14a55bbabb70fbacd495a23d355662a679fbca321c38eb46e37949ea51e2e290ad7558af9
Behavioral task
behavioral1
Sample
RFQ-MNAMR-001RB-WhastsAAp Images.exe
Resource
win7v20201028
Malware Config
Extracted
formbook
http://www.salomdy.com/xcm/
xn--rhq5es99j.com
storage-download-fast.review
campingfamilly.com
rientbottcieux.info
2015z.com
999izo.info
guojiafangshui.com
jpaecwra.com
evergreenmga.net
semprebellissima.store
meizin01.com
bangladesherkhobor.net
rivercoveresidencessg.com
carbonfibercrew.com
1rbld2.biz
nikolatesla.review
erlandsonsbrygga.com
cursosreikiadistancia.com
centraldemotorersltda.com
shelskysbrooklynbagels.com
ferfectifyplns.date
gzxj360.com
mshaldernetwork.com
bitejinbi.com
annemariescallan.com
dopcs.com
ignaciobandera.com
hanza-trade.com
mr605.com
smartgridbattery.com
irma.center
imagilt.com
sandy-beauty.com
wildwestshavingco.com
crypto-hardware-wallets.com
nichollspublishing.com
themeancompany.com
weiyilay.com
hinhsex.net
yuyuebaichuan.com
gremioimortaltricolor.com
40wgwg.com
im-i.com
775manbetx.com
skyfieldandgreen.net
biangl.com
jalexsanger.life
kaitlynlagrega.com
bonus-karamba.info
doralcourthandbook.com
hamsterpetcare.com
silco-structural.com
bihanarabi.com
nonelit.com
nagercoilcorporation.com
favoritetrafficupdating.online
corporate1.biz
searchlightroundup.biz
113839stse.com
electric-dinosaur.com
easyworldnewscom.faith
darnellprince.com
szsotx.com
mortgagesaremyjam.com
Targets
-
-
Target
RFQ-MNAMR-001RB-WhastsAAp Images.exe
-
Size
398KB
-
MD5
239efcf744fc1e906b704d4eebe4a962
-
SHA1
c8c0fe13941c237cd72c2eb3adcfc13f9513d32d
-
SHA256
aae9b362789cdf8a185d9b963cb3b0ba5d7f5599285cecd8625944168232c42c
-
SHA512
affe8bdcfbdc3e2554f2b8c887a9d417a69b5e031f7433ecf8971cc14a55bbabb70fbacd495a23d355662a679fbca321c38eb46e37949ea51e2e290ad7558af9
-
Formbook Payload
-
Adds policy Run key to start application
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-