General
- Target 6b0128e753b4c8eb55a0726dbdbbf35e.exe
- Size 1.0MB
- Sample210113-h2xpcmfwdx
- SHA256 0ae22d4877231b64b2e9e1252bbe8636ea43fe5692ca899733e715ccfc82e224
- MD5 6b0128e753b4c8eb55a0726dbdbbf35e
- SHA1 12ab2a6cb7c26acad4ba209bafdb6fd2ff33523b
- SHA512 152e90baebb510c397a7625ec9295ea806d4c233b00df8a938c9f62ea5966f88873b26558cb03131ba992ce7713704b2f2aeb90394bf46355eb6f16d119932f7
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
6b0128e753b4c8eb55a0726dbdbbf35e.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.zglvyouzaixian.com/nki/
-
igo-digiworld.com
-
infrahiit.com
-
herhealingwater.com
-
inspiredbytradition.com
-
onlinepropertyworld.com
-
rvwdj.com
-
mudahbikinsuhi.online
-
multipleofferonline.com
-
striveyouthministry.com
-
affectiveneuro.net
-
f21m.com
-
perfumefashion.icu
-
instantcash4rvs.com
-
help-verifiedbadge.com
-
solomonislandsblog.com
-
vipshoppingwizard.com
-
doggybargains.com
-
fjyaoxi.net
-
luxpropertyandassociates.com
-
companyfinders.com
-
alifeflooring.com
-
watermeloncrypto.com
-
internationalaid.global
-
petrosu.net
-
fireyourschool.com
-
gofawerunebe.com
-
lazystorage.com
-
tgasstore.com
-
adoniskitchenbath.com
-
it4cracks.com
-
revsharez.com
-
radioroutiers.com
-
szalun.com
-
theacademylife.com
-
jackcdoherty.com
-
theselfcaremenu.com
-
arentist.com
-
skyfun.asia
-
kroumoda.com
-
brodskikonetejneri.com
-
citestmansoon3445.com
-
laalianza.net
-
lwfenterprises.com
-
changeledger.com
-
x-box2send15.club
-
postraducion.xyz
-
kpybevx.icu
-
lolamind.com
-
jaipurethnic.com
-
candixenergy.com
-
degreespoint.com
-
311tac.com
-
donationwheel.com
-
ps3e.com
-
hyderabadcycles.com
-
nehyam.com
-
eversouthhangzhou.com
-
modaemira.com
-
k2bsi.com
-
jiopan.com
-
wheelerfamilyhistory.net
-
htaxbiz.com
-
somethinggotmestarted.com
-
aprilsbookkeeping.com
Targets
-
- Target 6b0128e753b4c8eb55a0726dbdbbf35e.exe
- Size 1.0MB
- SHA256 0ae22d4877231b64b2e9e1252bbe8636ea43fe5692ca899733e715ccfc82e224
- MD5 6b0128e753b4c8eb55a0726dbdbbf35e
- SHA1 12ab2a6cb7c26acad4ba209bafdb6fd2ff33523b
- SHA512 152e90baebb510c397a7625ec9295ea806d4c233b00df8a938c9f62ea5966f88873b26558cb03131ba992ce7713704b2f2aeb90394bf46355eb6f16d119932f7
- MD5 SHA1 SHA512
Formbook Payload
Suspicious use of SetThreadContext