General
- Target Purchase Order 40,7045.exe
- Size 339KB
- Sample201121-blaeav9v7x
- SHA256 7d4d5ddf016f84445c94bf5ee4d715be092f8711b70ebd17f48f2956fba0487d
- MD5 2566aac2faf57e27d8778f2c61bac6d3
- SHA1 b163ec807fe59a0f85f2d964fe1e8ffa8adab77e
- SHA512 f4e1fabcb5036f7adda5789f91dfdcfeada6dbfb0c8ed33ff76acf7d42f8f0e74041332684310572bd449b23ec5a7f10ef25245f78007fa70a10c14d646c6250
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 40,7045.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.sweetbasilmarketing.com/igqu/
-
coveloungewineandwhiskey.com
-
chemtradent.com
-
educare.cloud
-
shopnicknaks.com
-
realitytvstockwatch.com
-
handsfreedocs.com
-
trafegopago.com
-
ariasu-nakanokaikei.com
-
allmm.info
-
elleatx.com
-
erpsystem.site
-
whatisastaxanthin.com
-
hemparcade.com
-
ownumo.com
-
pasumaisangam.com
-
theoutdoorbed.com
-
plantpowered.energy
-
elevenelevenapparelcompany.com
-
vrspace.ltd
-
justsoldbykristen.com
-
pintudada.com
-
147design.com
-
cashintl.com
-
atal.ltd
-
forbigdogs.com
-
onlineshoppingisbest.com
-
pharmacysouq.com
-
placeduconfort.com
-
lotoencasa.com
-
mobileoilxchange.com
-
rockinglifefromhome.com
-
covid19salivatestdirect.com
-
hyx20140813.com
-
indorebodybilaspur.com
-
heartandcrowncloset.com
-
fireandcrystal.com
-
rbnrf.com
-
obsessingwealth.com
-
yslh88.com
-
guidesgold.net
-
thoughtslate.com
-
primeworldgroup.com
-
yogapants.xyz
-
lostandfoundpetsalabaster.com
-
dua.fund
-
namofast.com
-
royaloakpublishing.com
-
gayfuse.com
-
tumulusanalytics.com
-
kayapallisgaard.com
-
ppc-listing.info
-
allan-wren.com
-
uneducationofamerica.com
-
majhulworld.com
-
the-gongs.com
-
hybrideve.com
-
lwpevolve.com
-
fahufu.com
-
k-fpa.com
-
roboleadsystem.com
-
capitalcitybombers.com
-
searchnehomes.com
-
maninhatphoto.com
-
happinestbuilders.com
Targets
-
- Target Purchase Order 40,7045.exe
- Size 339KB
- SHA256 7d4d5ddf016f84445c94bf5ee4d715be092f8711b70ebd17f48f2956fba0487d
- MD5 2566aac2faf57e27d8778f2c61bac6d3
- SHA1 b163ec807fe59a0f85f2d964fe1e8ffa8adab77e
- SHA512 f4e1fabcb5036f7adda5789f91dfdcfeada6dbfb0c8ed33ff76acf7d42f8f0e74041332684310572bd449b23ec5a7f10ef25245f78007fa70a10c14d646c6250
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext