General
- Target PO-000202112.exe
- Size 1.0MB
- Sample210113-qpr2ssfnns
- SHA256 c3a69db8642855e1dfcbcb213f7f050c5fb2d86744183b13483411f97009c2a0
- MD5 673900f8da4aa24a77f61417d0273d85
- SHA1 0d04e357ccb332b63b1a8d9d4e9f6b889c2f0b77
- SHA512 63c30b550f314620cdc961eb1dcb0c91e8f9b702aa722f34b0c81c308ac5f44ab9818bd12fb8e13aabc6ed3bab16b6df90b1727aed976fcf86ee4a0422adfde6
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
PO-000202112.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.culturespk.com/kbl/
-
flamesapp.com
-
ravenridgehoa.com
-
epraggma.com
-
stupidbooks.com
-
jointhesadls.com
-
estavisaapplication.com
-
12minhomebusiness.com
-
wwddww.com
-
stratusdetroitmail.com
-
storevanguard.com
-
cadeaux-et-gadgets.com
-
vbnfnleoba.club
-
ilikecircles.com
-
inspirednycharm.com
-
baizhongcai.com
-
medinius.info
-
call0815.com
-
vastu618.com
-
beautyshopin.com
-
looksplanet.com
-
sdtmds.com
-
bloominglips.com
-
housingbits.bid
-
file-anae.com
-
twin-force.com
-
alt-sys.tech
-
ishq-tea.com
-
hyderss.online
-
torontointhesummer.com
-
freisaq.com
-
mafiaconsortium.com
-
fashenchat.com
-
osakanadaisuki.info
-
valaria.store
-
mormoncdn.com
-
skin-rubble.com
-
geekertv.com
-
sanb62.com
-
breedroom.com
-
atlantamicroschool.com
-
shopsouthernthreads.com
-
attractiverentals.com
-
carolinemackinnonart.com
-
thestyleshrine.com
-
kushion.net
-
n88n88.com
-
virtualpropertybuilders.com
-
serenityhealthfitness.com
-
pathley.com
-
qanondon.com
-
hoodrated.com
-
lampuantikunik.com
-
shilohnurserytrees.com
-
giveaways-usa.com
-
com960.com
-
colibrijecoffee.com
-
vajraways.com
-
doubledragonrecordingstudio.com
-
certostech.com
-
haoyuanantong.com
-
eaplsy.com
-
spanishtutorservice.com
-
lassgal.com
-
nowananimal.com
Targets
-
- Target PO-000202112.exe
- Size 1.0MB
- SHA256 c3a69db8642855e1dfcbcb213f7f050c5fb2d86744183b13483411f97009c2a0
- MD5 673900f8da4aa24a77f61417d0273d85
- SHA1 0d04e357ccb332b63b1a8d9d4e9f6b889c2f0b77
- SHA512 63c30b550f314620cdc961eb1dcb0c91e8f9b702aa722f34b0c81c308ac5f44ab9818bd12fb8e13aabc6ed3bab16b6df90b1727aed976fcf86ee4a0422adfde6
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext