General
-
Target
6b0128e753b4c8eb55a0726dbdbbf35e.exe
-
Size
1.0MB
-
Sample
210113-h2xpcmfwdx
-
MD5
6b0128e753b4c8eb55a0726dbdbbf35e
-
SHA1
12ab2a6cb7c26acad4ba209bafdb6fd2ff33523b
-
SHA256
0ae22d4877231b64b2e9e1252bbe8636ea43fe5692ca899733e715ccfc82e224
-
SHA512
152e90baebb510c397a7625ec9295ea806d4c233b00df8a938c9f62ea5966f88873b26558cb03131ba992ce7713704b2f2aeb90394bf46355eb6f16d119932f7
Static task
static1
Behavioral task
behavioral1
Sample
6b0128e753b4c8eb55a0726dbdbbf35e.exe
Resource
win7v20201028
Malware Config
Extracted
formbook
http://www.zglvyouzaixian.com/nki/
igo-digiworld.com
infrahiit.com
herhealingwater.com
inspiredbytradition.com
onlinepropertyworld.com
rvwdj.com
mudahbikinsuhi.online
multipleofferonline.com
striveyouthministry.com
affectiveneuro.net
f21m.com
perfumefashion.icu
instantcash4rvs.com
help-verifiedbadge.com
solomonislandsblog.com
vipshoppingwizard.com
doggybargains.com
fjyaoxi.net
luxpropertyandassociates.com
companyfinders.com
alifeflooring.com
watermeloncrypto.com
internationalaid.global
petrosu.net
fireyourschool.com
gofawerunebe.com
lazystorage.com
tgasstore.com
adoniskitchenbath.com
it4cracks.com
revsharez.com
radioroutiers.com
szalun.com
theacademylife.com
jackcdoherty.com
theselfcaremenu.com
arentist.com
skyfun.asia
kroumoda.com
brodskikonetejneri.com
citestmansoon3445.com
laalianza.net
lwfenterprises.com
changeledger.com
x-box2send15.club
postraducion.xyz
kpybevx.icu
lolamind.com
jaipurethnic.com
candixenergy.com
degreespoint.com
311tac.com
donationwheel.com
ps3e.com
hyderabadcycles.com
nehyam.com
eversouthhangzhou.com
modaemira.com
k2bsi.com
jiopan.com
wheelerfamilyhistory.net
htaxbiz.com
somethinggotmestarted.com
aprilsbookkeeping.com
Targets
-
-
Target
6b0128e753b4c8eb55a0726dbdbbf35e.exe
-
Size
1.0MB
-
MD5
6b0128e753b4c8eb55a0726dbdbbf35e
-
SHA1
12ab2a6cb7c26acad4ba209bafdb6fd2ff33523b
-
SHA256
0ae22d4877231b64b2e9e1252bbe8636ea43fe5692ca899733e715ccfc82e224
-
SHA512
152e90baebb510c397a7625ec9295ea806d4c233b00df8a938c9f62ea5966f88873b26558cb03131ba992ce7713704b2f2aeb90394bf46355eb6f16d119932f7
-
Formbook Payload
-
Suspicious use of SetThreadContext
-