General
- Target AWBInvoice INA10197.exe
- Size 927KB
- Sample201228-ph555bhfp2
- SHA256 cd3afb904bdbe5aa145aca40398017b76ef22f9fa85556c728f38744d57a3352
- MD5 cb0756bd152f58149968469cb64d8751
- SHA1 72be43f36f39dbe3489256922cad51337b0ade1c
- SHA512 53bd2b3178f263eccd8b8f772fa65b87b62de2c1cb82eb844657e07416b6f1fb740a66e8c4c2cc7a7345b9551dbf504cf0b35e3ce63632652f5a64b8bdb530c9
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
AWBInvoice INA10197.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.ameeraglow.com/6bu2/
-
shuttergame.com
-
beyondregions.com
-
cuttingedgetinting.com
-
riveraspanishfoods.com
-
jfksn.com
-
rtplay2020.com
-
idahofallsobituaries.com
-
qf432.com
-
magandaconfections.com
-
suremlak.com
-
tuproductividadpersonal.com
-
ziswmyxaw.icu
-
howtolovemybody.com
-
signpartnerpro.com
-
conservative-forward.com
-
bhscsh.com
-
todowine.com
-
garrettthermaldetector.com
-
bunbook.com
-
ehealthla.com
-
mojacreations.com
-
2kantxt.com
-
aqustea.com
-
sheilataman.com
-
phymath.science
-
sctuba.com
-
columbusestatesseniorliving.com
-
opyalliy.pro
-
bestgiftforu.com
-
cad-office-iserlohn.com
-
gorgeus-girl-full-service.today
-
easthaus-modern.com
-
snoozefest.online
-
service-xwcrvxsz.icu
-
flavourcosmetics.com
-
news247alert.com
-
944ka.xyz
-
bcheap3dmall.com
-
crepkonnect.com
-
purelili.com
-
pushupbras.net
-
ctsafaris.com
-
sprinkleforever.com
-
engagingsci.coach
-
aihint.com
-
icxrus.com
-
7vitrines.com
-
mrsgariepy.com
-
bikewitha.pro
-
adv-assist.com
-
youlacka.com
-
languagekickstart.com
-
commonscentsbychloe.com
-
o-tanemaki.com
-
wlgdrs.com
-
imbentaryo.com
-
winwithrundlemall.com
-
jumben.xyz
-
24k88lotto.com
-
bundlesofjoihair.com
-
bukannyaterbuai31.com
-
essentialeatscatering.com
-
brasseriedufayard.com
-
trumpvotr.com
Targets
-
- Target AWBInvoice INA10197.exe
- Size 927KB
- SHA256 cd3afb904bdbe5aa145aca40398017b76ef22f9fa85556c728f38744d57a3352
- MD5 cb0756bd152f58149968469cb64d8751
- SHA1 72be43f36f39dbe3489256922cad51337b0ade1c
- SHA512 53bd2b3178f263eccd8b8f772fa65b87b62de2c1cb82eb844657e07416b6f1fb740a66e8c4c2cc7a7345b9551dbf504cf0b35e3ce63632652f5a64b8bdb530c9
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext