General
- Target List items.exe
- Size 929KB
- Sample201209-1812apmm4a
- SHA256 42ea844a6aeb6c01de060355e8333242f71553498514ca1bf7d4af32bb90803e
- MD5 56264f145444a81433f551c1f70af906
- SHA1 29a4c497ff6b22f622030bc3cd10d40778e3a5f7
- SHA512 a8badad866e1f67bdf894437ae9e9a1e9bfaaf0d42d901497ba195c70b9de0fd35323d212f3d9f170418cac470010ed98a9aff7d72c7b1b38025d5a4d8c3ffa7
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
List items.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.lalaandthelight.com/hts/
-
nymphomaniartist.com
-
thinkntyme.com
-
standardpharm.net
-
untangledesign.com
-
adrisable.com
-
theforgottencolony.com
-
renderpharma.com
-
jp231c.com
-
psilocybinenergy.com
-
oirtfqe.icu
-
viontelhotel.com
-
hotbloodedradio.com
-
motorstoretr.com
-
lapstan.com
-
takeexperts.com
-
elyzabeth.site
-
nicoloshoots.com
-
russpotts.com
-
forenvid.com
-
healinghappens.life
-
timelessbeautylessons.com
-
koahswim.com
-
man-bath.com
-
addmeonsnapchat.com
-
ztvwgqjyb.com
-
erinner21.com
-
tunnelshift.com
-
long263.com
-
daogushichang.com
-
everauty.com
-
jc975.com
-
av-erodouga.com
-
pauloa.com
-
internationalcondostore.com
-
lighthouse360llc.com
-
adobe-photo-shop-7.com
-
redwoodvisitor.com
-
firefrontpage.com
-
meaestate.com
-
hanghoa2019.com
-
capsurlafrik.com
-
handmadepainkiller.com
-
floridacanadianhorses.com
-
carladetetive.com
-
pop-up-stores.info
-
traceryarts.com
-
twamsolutions.com
-
wabawab.com
-
ascensorespacific.com
-
sportphotosforless.com
-
mclartynissanofbenton.com
-
lshhan.com
-
xuexinao.com
-
bestpowerandhandtools.com
-
nahuwapnm-t.com
-
thepathnotbeaten.com
-
libertetimes.com
-
yuexi123.com
-
evcce.com
-
peoplewithbicycles.com
-
businessedge360.com
-
hyfinery.com
-
guatemalafacemasks.com
-
eegconsultants.com
Targets
-
- Target List items.exe
- Size 929KB
- SHA256 42ea844a6aeb6c01de060355e8333242f71553498514ca1bf7d4af32bb90803e
- MD5 56264f145444a81433f551c1f70af906
- SHA1 29a4c497ff6b22f622030bc3cd10d40778e3a5f7
- SHA512 a8badad866e1f67bdf894437ae9e9a1e9bfaaf0d42d901497ba195c70b9de0fd35323d212f3d9f170418cac470010ed98a9aff7d72c7b1b38025d5a4d8c3ffa7
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext