General
- Target Quotation Request No - 203.exe
- Size 943KB
- Sample201204-8xknpy2rgx
- SHA256 11ed6cc2222d5e0db7cc26544b9acf7370f2dab930e73a7268d388d73674b776
- MD5 7c48fcc1ac6d150326af0635cdc81490
- SHA1 0dcfcb55ddea49ac7629d1e126a57f8f0f8c70b8
- SHA512 073fef9c442c3c3ca53e6e645faff9d20ca8f52cf68e9e481bbf66907526464b1b065c5014ae1390e10d4897bccd6b7124b4095eb99c51200de09db3e0ddc68d
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Quotation Request No - 203.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.danneroll.com/mnc/
-
yicaiboli.com
-
litercoconut.icu
-
virtuallyfriday.com
-
joshuahumphreyproperty.com
-
mercedes-dieselclaims.com
-
rock-leaf.com
-
sandglasshours.com
-
pooldeckpatiodriveway.com
-
forenvid.com
-
wasserfuhr-gmbh.com
-
rizosmil.com
-
alberletgyor.com
-
besafetexting.com
-
ladoctoracorazon.net
-
prettyassframes.com
-
meetyourwish.com
-
achefskiss.com
-
parulata.com
-
thang8-freefirevn2.xyz
-
statuniverse.com
-
autotenis.com
-
gosales.solutions
-
cryptocurrencymegalodons.com
-
anelimplus.com
-
oceanama.com
-
hagisiran.space
-
mphsalvageandrecovery.online
-
alluvionsupply.com
-
englishteachers4you.com
-
talkinghorseequine.com
-
alium-locum.com
-
musictechnologyshow.com
-
linjitejituan.com
-
fullmoondreams.com
-
csltzs.com
-
testovulacion.net
-
saboortii.com
-
tuyavietnam.com
-
localkaza.com
-
mppleague.com
-
ecomwealthfast.com
-
escariot.net
-
oceanpowerclub.com
-
thecraftssisters.info
-
pekinghousetntogo.com
-
avtnywveba.club
-
bf-milestone.com
-
sundeckofwashington.com
-
xn--clnicaimplantcenter-m1b.com
-
adenikitchen.com
-
ironolink.com
-
whyiteachpodcast.com
-
landscapedesignvalley.com
-
twobluemagpies.com
-
uovuesax.icu
-
willowlandingmarina.com
-
dy-bxg.com
-
yogacomsolutions.site
-
tootandscoot.com
-
newteethok.com
-
watchtherainbow.com
-
bazacar.com
-
alassalahgroup.net
-
sabioconteudo.com
Targets
-
- Target Quotation Request No - 203.exe
- Size 943KB
- SHA256 11ed6cc2222d5e0db7cc26544b9acf7370f2dab930e73a7268d388d73674b776
- MD5 7c48fcc1ac6d150326af0635cdc81490
- SHA1 0dcfcb55ddea49ac7629d1e126a57f8f0f8c70b8
- SHA512 073fef9c442c3c3ca53e6e645faff9d20ca8f52cf68e9e481bbf66907526464b1b065c5014ae1390e10d4897bccd6b7124b4095eb99c51200de09db3e0ddc68d
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext