General
- Target price list.exe
- Size 850KB
- Sample201202-lt63rsqccj
- SHA256 187785c7830aff67dd03a3bf3a067e9b760cb76f7367ee42c8e4b9c92b78d2e2
- MD5 8c001a13d09ba58968f1ff5283ebfe94
- SHA1 fc7955a7558b081d21c81d9e205831d8b5c21680
- SHA512 53861a101693c41ddbaa300943f40feacc502fde1bd04a4688e16aec00c63f63c8f65d7dc6323bfafbce6004f8a0fe15c26a2a2cc142b02de79d3ac753e1750e
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
price list.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.danneroll.com/mnc/
-
yicaiboli.com
-
litercoconut.icu
-
virtuallyfriday.com
-
joshuahumphreyproperty.com
-
mercedes-dieselclaims.com
-
rock-leaf.com
-
sandglasshours.com
-
pooldeckpatiodriveway.com
-
forenvid.com
-
wasserfuhr-gmbh.com
-
rizosmil.com
-
alberletgyor.com
-
besafetexting.com
-
ladoctoracorazon.net
-
prettyassframes.com
-
meetyourwish.com
-
achefskiss.com
-
parulata.com
-
thang8-freefirevn2.xyz
-
statuniverse.com
-
autotenis.com
-
gosales.solutions
-
cryptocurrencymegalodons.com
-
anelimplus.com
-
oceanama.com
-
hagisiran.space
-
mphsalvageandrecovery.online
-
alluvionsupply.com
-
englishteachers4you.com
-
talkinghorseequine.com
-
alium-locum.com
-
musictechnologyshow.com
-
linjitejituan.com
-
fullmoondreams.com
-
csltzs.com
-
testovulacion.net
-
saboortii.com
-
tuyavietnam.com
-
localkaza.com
-
mppleague.com
-
ecomwealthfast.com
-
escariot.net
-
oceanpowerclub.com
-
thecraftssisters.info
-
pekinghousetntogo.com
-
avtnywveba.club
-
bf-milestone.com
-
sundeckofwashington.com
-
xn--clnicaimplantcenter-m1b.com
-
adenikitchen.com
-
ironolink.com
-
whyiteachpodcast.com
-
landscapedesignvalley.com
-
twobluemagpies.com
-
uovuesax.icu
-
willowlandingmarina.com
-
dy-bxg.com
-
yogacomsolutions.site
-
tootandscoot.com
-
newteethok.com
-
watchtherainbow.com
-
bazacar.com
-
alassalahgroup.net
-
sabioconteudo.com
Targets
-
- Target price list.exe
- Size 850KB
- SHA256 187785c7830aff67dd03a3bf3a067e9b760cb76f7367ee42c8e4b9c92b78d2e2
- MD5 8c001a13d09ba58968f1ff5283ebfe94
- SHA1 fc7955a7558b081d21c81d9e205831d8b5c21680
- SHA512 53861a101693c41ddbaa300943f40feacc502fde1bd04a4688e16aec00c63f63c8f65d7dc6323bfafbce6004f8a0fe15c26a2a2cc142b02de79d3ac753e1750e
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext