General
- Target Tracking No_SINI0068206497.exe
- Size 1.0MB
- Sample201124-fdtfrcedz2
- SHA256 ef84b1824587f465b36bafcbfbe6a14953e6de0a9420904662ba207984782c80
- MD5 9392649b625bdbad5c5285c11af9625f
- SHA1 d116908898e0ad0c92146c3de9b07d7b410bd9b0
- SHA512 975af712e1e8352ce27f01cbc3d18e7d0446333510c11899db769da7a9a89aef24f5681ef3d4a95ac9e9f7718f4070996d49cd45c201cd18347df27cd95760f7
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Tracking No_SINI0068206497.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.libertraxengineering.com/rte/
-
thecreditcardcon.com
-
bcoltee.com
-
lyckaffe.com
-
lifebonusclub.com
-
hellolovelybookbox.net
-
robinsnesting.com
-
bunda7.com
-
showrov.online
-
mdfs.club
-
int-bp-departmt.com
-
grannymodern.com
-
bestdiany.com
-
inviotraffico.site
-
nymonroy.com
-
barberstradale.com
-
arvivsurgery.com
-
stylinglives.com
-
idealonerealty.com
-
riedelman.com
-
multicommerces.com
-
skiddawlgx.com
-
sieuthionline270.com
-
lakecitymetals.com
-
talbotboysstatue.com
-
wywindhere.net
-
nzuko-watu.com
-
hnjhdz.com
-
onkormiamicharters.com
-
starlet5.xyz
-
shoppstime.com
-
androiduv.com
-
mohammadsamad.net
-
exclusivehaat.com
-
privatecomfortinghands.com
-
viencancy.com
-
chunwen.xyz
-
privacycomplianceblog.com
-
belgiumishappening.net
-
micainthestars.com
-
marriottsurroundsound.com
-
beastbodiwear.com
-
filmesyabarrotes.com
-
leatherboundpounds.com
-
marcenariamodelo.com
-
allmusictv25.xyz
-
heglit.info
-
happyland-balloon.com
-
sropandshop.com
-
tjhuayougangguan.com
-
sntbrands.com
-
smartvillageonline.com
-
osierrb.com
-
madcat-eve.com
-
patientsfirstdocs.com
-
tuiliyi.com
-
railroadbrushcutting.com
-
joineduphealthresources.net
-
trxmef.info
-
kritiscorp.com
-
alphaone.business
-
vlofood.com
-
duzkiss.com
-
yourshopindia.com
-
lfdmfmldfmlref.com
Targets
-
- Target Tracking No_SINI0068206497.exe
- Size 1.0MB
- SHA256 ef84b1824587f465b36bafcbfbe6a14953e6de0a9420904662ba207984782c80
- MD5 9392649b625bdbad5c5285c11af9625f
- SHA1 d116908898e0ad0c92146c3de9b07d7b410bd9b0
- SHA512 975af712e1e8352ce27f01cbc3d18e7d0446333510c11899db769da7a9a89aef24f5681ef3d4a95ac9e9f7718f4070996d49cd45c201cd18347df27cd95760f7
- MD5 SHA1 SHA512
-
Formbook Payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext