General
- Target 350129441.exe
- Size 1.4MB
- Sample201222-t11vaft8jj
- SHA256 34cb445ac6f9c3dc60d465baa8ffbbca5abaf84fce4ff7075628e6cd1d41c559
- MD5 889c873694152d8246fa478aba1eb0ee
- SHA1 9a47f80d537e8f6b56440169a73dba51222a607c
- SHA512 ffb16e37972017b3deb365999e1c570eb7ccc46bc7e3b91d80a60cc8246b4648c0614c737dd15bc8a03fb8a221174fae802fd3445c251d7ab97d9c7f126b613a
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
350129441.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.ameeraglow.com/6bu2/
-
shuttergame.com
-
beyondregions.com
-
cuttingedgetinting.com
-
riveraspanishfoods.com
-
jfksn.com
-
rtplay2020.com
-
idahofallsobituaries.com
-
qf432.com
-
magandaconfections.com
-
suremlak.com
-
tuproductividadpersonal.com
-
ziswmyxaw.icu
-
howtolovemybody.com
-
signpartnerpro.com
-
conservative-forward.com
-
bhscsh.com
-
todowine.com
-
garrettthermaldetector.com
-
bunbook.com
-
ehealthla.com
-
mojacreations.com
-
2kantxt.com
-
aqustea.com
-
sheilataman.com
-
phymath.science
-
sctuba.com
-
columbusestatesseniorliving.com
-
opyalliy.pro
-
bestgiftforu.com
-
cad-office-iserlohn.com
-
gorgeus-girl-full-service.today
-
easthaus-modern.com
-
snoozefest.online
-
service-xwcrvxsz.icu
-
flavourcosmetics.com
-
news247alert.com
-
944ka.xyz
-
bcheap3dmall.com
-
crepkonnect.com
-
purelili.com
-
pushupbras.net
-
ctsafaris.com
-
sprinkleforever.com
-
engagingsci.coach
-
aihint.com
-
icxrus.com
-
7vitrines.com
-
mrsgariepy.com
-
bikewitha.pro
-
adv-assist.com
-
youlacka.com
-
languagekickstart.com
-
commonscentsbychloe.com
-
o-tanemaki.com
-
wlgdrs.com
-
imbentaryo.com
-
winwithrundlemall.com
-
jumben.xyz
-
24k88lotto.com
-
bundlesofjoihair.com
-
bukannyaterbuai31.com
-
essentialeatscatering.com
-
brasseriedufayard.com
-
trumpvotr.com
Targets
-
- Target 350129441.exe
- Size 1.4MB
- SHA256 34cb445ac6f9c3dc60d465baa8ffbbca5abaf84fce4ff7075628e6cd1d41c559
- MD5 889c873694152d8246fa478aba1eb0ee
- SHA1 9a47f80d537e8f6b56440169a73dba51222a607c
- SHA512 ffb16e37972017b3deb365999e1c570eb7ccc46bc7e3b91d80a60cc8246b4648c0614c737dd15bc8a03fb8a221174fae802fd3445c251d7ab97d9c7f126b613a
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext