General
- Target inss.exe
- Size 312KB
- Sample210114-jexvxb1bfa
- SHA256 02cd99f8d843c4c63d55b4bebe044e5205e81f31ad36af77b9a99734c074f0a8
- MD5 b6261a6fd212f3fff1ee509c5b26ea43
- SHA1 a9039586f41a042625ebe7609cb6802204d3f3a8
- SHA512 99f9032a300fb95c8f959d815df42255f2b15c516ddd494158cdef6293023bf53e9c78dcbd2244be9732a0da6dcaa38ddf16da1e8a64ec0f1b893f4b6f4dfa83
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
inss.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.besthandstool.icu/uds2/
-
hrrecruitertraining.com
-
pancakeroll.club
-
equiposddl.com
-
fab-9corporation.com
-
seanformo.com
-
fisika-uinam.com
-
cheeseburgerpasta.com
-
cherylkarlfineartist.com
-
wunderprodukte.net
-
3912699.com
-
sanitizyo.com
-
856381190.xyz
-
aprobet42.xyz
-
knutsfastigheter.com
-
disalvospizzaitalian.com
-
energysavingsolarpower.com
-
oldwonderful.com
-
se32688.com
-
samkecollection.com
-
colegioreynosa.com
-
choujiushui.com
-
njxgwxzx.com
-
bairdexotics.com
-
concur.design
-
terrenosenofertaqueretaro.com
-
demenageseul.com
-
blvdabbey.com
-
asghargloves.com
-
livesoft.xyz
-
dropdevil.com
-
goldenhills-serpong.com
-
haxb33.xyz
-
splendid-nail.com
-
indisburse.com
-
indianapolishousepainter.com
-
seak.xyz
-
prohealth.today
-
claudiarecom.com
-
mariemenor.com
-
surethingdesigns.com
-
musesgirl.com
-
hackmaninsurance.com
-
partut.com
-
smokeflake.com
-
conhecimentovivo.science
-
animalbiologics.com
-
spontaneoushomeschooler.com
-
thedailytrack.com
-
zerofive100.com
-
cyberfoxbat.com
-
thepassvacation.com
-
worldagroecologyalliance.com
-
qsnlnntxg.icu
-
destinationssc.com
-
transparentnutritions.com
-
millcreekimports.com
-
cptdesignstudio.com
-
isaacphotorestoration.com
-
daxuangou.com
-
redgumhomestead.com
-
comsodigital.com
-
sxweilan.com
-
andrewsreadingjournal.com
-
matchmakergenetics.com
Targets
-
- Target inss.exe
- Size 312KB
- SHA256 02cd99f8d843c4c63d55b4bebe044e5205e81f31ad36af77b9a99734c074f0a8
- MD5 b6261a6fd212f3fff1ee509c5b26ea43
- SHA1 a9039586f41a042625ebe7609cb6802204d3f3a8
- SHA512 99f9032a300fb95c8f959d815df42255f2b15c516ddd494158cdef6293023bf53e9c78dcbd2244be9732a0da6dcaa38ddf16da1e8a64ec0f1b893f4b6f4dfa83
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext