General
-
Target
RFQ_19-027-MP-010203 _ 19-028-MP-010203 _ 19-029-MP-04.exe
-
Size
1.5MB
-
Sample
210119-rvx79zcyc6
-
MD5
b2661762dc1e404771a05acaa650a8ad
-
SHA1
48a6b21d8df818d53da12fbf245dd0425719ca1d
-
SHA256
5fb176b2add40ae0aed7db10e9bf4755c86b63d66d4601370605b318d5bdb4b1
-
SHA512
eace4950d5a1f465411a4808265840acc9f95d095939b4c38b4854b7939593116e4c5e5de43c6bef982a7e41330f393effcea2249aa5aeea5c6125d3a022c01b
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_19-027-MP-010203 _ 19-028-MP-010203 _ 19-029-MP-04.exe
Resource
win7v20201028
Malware Config
Extracted
formbook
http://www.insuranceforgrass.com/cdl/
camerawifichinhhang.info
fourruchos.com
linyomould.com
rockinghamseattle.com
yax95.com
gardenvaleps-athletics.com
fundaciojaumecasademont.cat
balpreetpankaj.com
flatlyforensics.com
nehyam.com
hundredpushup.com
iqellc.com
heemosco.com
wavegoodbyeto2020.com
idea2u.net
villamoonray.com
cloud9nutrition.com
propertybysyazliaty.com
chatbgsssjeni.com
babyessentialsonline.com
theunfilteredreviewer.com
nyscotarts.com
kingsheikh.com
navigatorcruisesapp.online
zarahcoll.com
fadedinfusions.com
charliesellscharlestonsc.com
auraatquaterpath.com
tzy027.com
garethjamesproperties.com
xn--b20b78vjoc1r8a.com
bestillsko.com
nyarlatho.com
ofleaves.com
thebaebutter.com
dhlcargopackersandmovers.com
audiovisualesjacr.com
centralharbormgmt.com
forexticket-th.com
reaera.xyz
wii2review5.club
st-insurance.net
sswgasia.com
silverdayzee.com
xn--planungsbro-stanko-u6b.com
marcellelizabeth.life
grroovepages.com
minevibe.net
ezhong.cool
mcj24.com
swiftsymphony.com
woodcrofthomeimprovement.com
alfijah.com
srishanmukhadevelopers.com
tnmsolutions.net
wheelshrine.com
groupmimoza.com
biaobazhongxin.com
elrodeorestaurantbw.com
bossupandwrite.com
ldmslondon.com
dldaduhui.com
llevel.club
pwrsbb.com
Targets
-
-
Target
RFQ_19-027-MP-010203 _ 19-028-MP-010203 _ 19-029-MP-04.exe
-
Size
1.5MB
-
MD5
b2661762dc1e404771a05acaa650a8ad
-
SHA1
48a6b21d8df818d53da12fbf245dd0425719ca1d
-
SHA256
5fb176b2add40ae0aed7db10e9bf4755c86b63d66d4601370605b318d5bdb4b1
-
SHA512
eace4950d5a1f465411a4808265840acc9f95d095939b4c38b4854b7939593116e4c5e5de43c6bef982a7e41330f393effcea2249aa5aeea5c6125d3a022c01b
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-