General
- Target 13012021.exe
- Size 1.0MB
- Sample210113-hyn52828dn
- SHA256 ae73e8799690e6e7efe2222fe8a471af2c7f7f0f82dff259434626eac35a2721
- MD5 5a3dfc0ef78aab90422df535e97cbe9c
- SHA1 37a8d89122bd0555e3a83e4940ff1871892f55f6
- SHA512 63713d49cb4c3d1cadf05be96bfb6c1e9152b999a99ce9567c634d382e45885ade8acc0aaae3771a4396038337e1f31d2d3a50214bebc452e2e21f9010540c9e
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
13012021.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.timoniks.com/rbg/
-
fingermode.com
-
parkplace.finance
-
hollandgreen2020.com
-
starbets.site
-
vehiculesfrigorifiques.com
-
sydiifinancial.com
-
rpivuenation.com
-
freesubdirectory.com
-
independencepartynyc.com
-
dogruparti.info
-
independencecountyclub.com
-
midnightlashesbykim.com
-
digitalsept.com
-
whatilikeabouttoday.com
-
marktplaatsaccount.info
-
13400667334.com
-
xinwei-ge.com
-
login-appleid.info
-
momashands.com
-
kennyxpress.com
-
yushin2733.com
-
olenfex.com
-
agorabookstore.com
-
iotajinn.com
-
511tea.com
-
sullian.com
-
virtuallawyerservices.com
-
machineryhunters.online
-
mintamuntaz.com
-
sunflowerhybrid.com
-
hocbai24h.com
-
bundletvdeal.com
-
engjape.com
-
villamariaapartments.com
-
arabaozellikleri.net
-
fortheloveofdawg.com
-
mullinsmusicministry.com
-
rescuecellphones.com
-
infinityenterpriselr.com
-
humormug.com
-
summitplazagurgaon.com
-
rogo24.com
-
apluspartybus.com
-
chernliyfashion.com
-
presentvaluecore.com
-
bangbangfactory.com
-
leandroresolve.com
-
hk6628.com
-
anotherheadache.com
-
jiemanwu.com
-
a1dandyhandyman.com
-
pennsylvaniacraft.com
-
vrank.icu
-
avivemg.icu
-
littlestarenglish.com
-
jrprofessionale.com
-
belze.net
-
svtrbu.com
-
healthpassportasia.com
-
kadakudu.com
-
rahatindir.com
-
seamssewmuchbetter.com
-
brancusi.net
-
ido.lgbt
Targets
-
- Target 13012021.exe
- Size 1.0MB
- SHA256 ae73e8799690e6e7efe2222fe8a471af2c7f7f0f82dff259434626eac35a2721
- MD5 5a3dfc0ef78aab90422df535e97cbe9c
- SHA1 37a8d89122bd0555e3a83e4940ff1871892f55f6
- SHA512 63713d49cb4c3d1cadf05be96bfb6c1e9152b999a99ce9567c634d382e45885ade8acc0aaae3771a4396038337e1f31d2d3a50214bebc452e2e21f9010540c9e
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext