General
- Target invoic.exe
- Size 358KB
- Sample201218-1e77twjybj
- SHA256 e59d9d9ca9e0c7dddea9a94f0dab0ae137b6a762999bade26db35b1ca35e1f72
- MD5 c283a8ac2f353078f965d522d810b43c
- SHA1 ffe1636aa203450e069146e8bb37a651dfeb85b6
- SHA512 0a4e6d3764d45e312808457d461950350eedf7d13b138e2fd7818b6773831547ae8e18b7ad01cf7b7ee9171158c9b331f26833c229b655a4894f8b1329a2e37f
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
invoic.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.helpmeiminmytwenties.com/oncs/
-
premiokapuscinski.com
-
metrteor.com
-
alignablesolutions.com
-
wajevctytwe.com
-
prospervine.net
-
camsplaces.com
-
kart-im.com
-
neothecode.com
-
fishingpeer.com
-
soulcave.xyz
-
bobqp6.com
-
phonpiegift.club
-
veteranmadecontent.com
-
domini-o-pessoal.com
-
featuredtv.com
-
thebugbros.com
-
gamedesignpostmortem.com
-
equineluv.com
-
zhongden.com
-
pbwts.com
-
codedad.club
-
lookoutwineclub.com
-
rbsuee.com
-
incrediwix.com
-
jumben.xyz
-
powerbikemonkey.com
-
astrowarrier.com
-
youjustbelieve.com
-
point1properties.com
-
heredley.com
-
mgrernn.xyz
-
tdmshops.com
-
nutritionlives.com
-
pb9hytgb5wry7.net
-
discoverafrica365.com
-
ematry.com
-
disneyholics.com
-
quelbelart.com
-
worldwidetrafficker.com
-
papervapors.com
-
qhxzddc.com
-
lofifoodie.com
-
icknw.com
-
aadudnd3.life
-
getsuccesnow.com
-
qs-dress.com
-
mstaffingagency.com
-
sexmomsonsister.cloud
-
sarahbell.net
-
alltrendsbrands.com
-
tostonet.com
-
mokrie-pizdi.site
-
limpieza-facial.com
-
nordinenas.ovh
-
sietec.science
-
duecugini.com
-
domentemenegi54.net
-
15055984691.com
-
cyland.net
-
interviewsbybethany.com
-
hmg777g.com
-
ryandouglaspublishing.com
-
wineenthusiasms.com
-
thefeelgoodsisters.com
Targets
-
- Target invoic.exe
- Size 358KB
- SHA256 e59d9d9ca9e0c7dddea9a94f0dab0ae137b6a762999bade26db35b1ca35e1f72
- MD5 c283a8ac2f353078f965d522d810b43c
- SHA1 ffe1636aa203450e069146e8bb37a651dfeb85b6
- SHA512 0a4e6d3764d45e312808457d461950350eedf7d13b138e2fd7818b6773831547ae8e18b7ad01cf7b7ee9171158c9b331f26833c229b655a4894f8b1329a2e37f
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext