General
- Target AWBInvoice INA101970.exe
- Size 830KB
- Sample201229-9ae99nnee2
- SHA256 7c3b63765f896c6e5faf093f002fa0f854994a1ea028a9abf53e7fdc8a3f18a4
- MD5 f52ccec51065d5d653daf93081f1fd0a
- SHA1 c7086ce5ceff00eea11ba80e373ac712e399573c
- SHA512 586306e9590ba993aff699cd2273fe2fc4d958d9e14b137372db3ef1d95a744793ababd3562753b73a5ca0cec0c36317fa44a092c0441a095b29c51660aa70ce
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
AWBInvoice INA101970.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.ameeraglow.com/6bu2/
-
shuttergame.com
-
beyondregions.com
-
cuttingedgetinting.com
-
riveraspanishfoods.com
-
jfksn.com
-
rtplay2020.com
-
idahofallsobituaries.com
-
qf432.com
-
magandaconfections.com
-
suremlak.com
-
tuproductividadpersonal.com
-
ziswmyxaw.icu
-
howtolovemybody.com
-
signpartnerpro.com
-
conservative-forward.com
-
bhscsh.com
-
todowine.com
-
garrettthermaldetector.com
-
bunbook.com
-
ehealthla.com
-
mojacreations.com
-
2kantxt.com
-
aqustea.com
-
sheilataman.com
-
phymath.science
-
sctuba.com
-
columbusestatesseniorliving.com
-
opyalliy.pro
-
bestgiftforu.com
-
cad-office-iserlohn.com
-
gorgeus-girl-full-service.today
-
easthaus-modern.com
-
snoozefest.online
-
service-xwcrvxsz.icu
-
flavourcosmetics.com
-
news247alert.com
-
944ka.xyz
-
bcheap3dmall.com
-
crepkonnect.com
-
purelili.com
-
pushupbras.net
-
ctsafaris.com
-
sprinkleforever.com
-
engagingsci.coach
-
aihint.com
-
icxrus.com
-
7vitrines.com
-
mrsgariepy.com
-
bikewitha.pro
-
adv-assist.com
-
youlacka.com
-
languagekickstart.com
-
commonscentsbychloe.com
-
o-tanemaki.com
-
wlgdrs.com
-
imbentaryo.com
-
winwithrundlemall.com
-
jumben.xyz
-
24k88lotto.com
-
bundlesofjoihair.com
-
bukannyaterbuai31.com
-
essentialeatscatering.com
-
brasseriedufayard.com
-
trumpvotr.com
Targets
-
- Target AWBInvoice INA101970.exe
- Size 830KB
- SHA256 7c3b63765f896c6e5faf093f002fa0f854994a1ea028a9abf53e7fdc8a3f18a4
- MD5 f52ccec51065d5d653daf93081f1fd0a
- SHA1 c7086ce5ceff00eea11ba80e373ac712e399573c
- SHA512 586306e9590ba993aff699cd2273fe2fc4d958d9e14b137372db3ef1d95a744793ababd3562753b73a5ca0cec0c36317fa44a092c0441a095b29c51660aa70ce
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext