General
-
Target
Payment Order Inv.exe
-
Size
770KB
-
Sample
201222-sdnwbnfm6s
-
MD5
66a395765d579f24cf42766d37072416
-
SHA1
e1884c073f2a3c11decba1f914e0ca4d3dc0eb11
-
SHA256
5b59e08e82994cd78df8856c5d7cfd4b30be947a9f7329af1a13d47652b189fc
-
SHA512
2fdf5f7f709ba0b77ba7b9707a8f532e1e5019087c1617b6eeaf362d466a40b7d47672d80a61e0a6c8e249c4ddc1f25d697ba51fd8c33d94cc83c11a020dd3e1
Static task
static1
Behavioral task
behavioral1
Sample
Payment Order Inv.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Payment Order Inv.exe
Resource
win10v20201028
Malware Config
Extracted
formbook
http://www.plantbasedtransporter.com/m98/
anesbensghair.com
crewsquid.com
thetekapp.com
africaisin.com
dodailyworkout.com
al-sultangate.com
aliciafowens.com
bbluebelt3dwdbuy.com
qjpay.pro
emotionalgun.club
guapasnatural.com
myessentials2020.com
cw-mag.com
petrousd.com
byyter.com
hima-tubusi.com
chapelcouture.com
thehollowcause.site
moskovganteng.com
2024project.com
olenfex.com
caiyisan.com
1d2g3m.com
aronaw.com
frontierautoglasslockport.com
pay-misfeel.com
noemiluquerodin.com
860703.com
management-h2g.com
chinadrac.com
click2hr.com
turf-safe.com
siltect.com
ash3ntv.com
carinsurably.com
saamacapital.com
bruceeng.com
agenciaebano.com
moscowcity.business
yogapants.xyz
lagoseyecenter.com
forccartex-tw.com
mytravel.travel
support-login-online.network
drinksbyfuego.com
quicksigningdoc.com
mikmake.net
sineflik.com
ekreysert.com
lifeinspiredgifts.com
ezpassnny.com
diskrab.com
masterbrandcabinetry.com
cosplaymaroc.com
xr3m.com
lakecharlesloan.com
parcelwolf.com
hellosunnyco.com
misery-indexrain.com
mysweetdreamsart.com
rothretirementsolutions.com
conecsa.group
onlinepedidos.com
learnstartupdesign.com
Targets
-
-
Target
Payment Order Inv.exe
-
Size
770KB
-
MD5
66a395765d579f24cf42766d37072416
-
SHA1
e1884c073f2a3c11decba1f914e0ca4d3dc0eb11
-
SHA256
5b59e08e82994cd78df8856c5d7cfd4b30be947a9f7329af1a13d47652b189fc
-
SHA512
2fdf5f7f709ba0b77ba7b9707a8f532e1e5019087c1617b6eeaf362d466a40b7d47672d80a61e0a6c8e249c4ddc1f25d697ba51fd8c33d94cc83c11a020dd3e1
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook Payload
-
ModiLoader First Stage
-
Adds policy Run key to start application
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-