General
- Target 02-016.exe
- Size 732KB
- Sample210216-lb2hyc4he6
- SHA256 fdf3aa0df3a0d4a6d053c55b970ad22f71f5db88f2da4f94bc18f1926b731f1b
- MD5 957014bc66c96533ca3cf65a5b355038
- SHA1 cedbfdb6bd9d4ee9397d2fe0bfab563b01c9ba2a
- SHA512 dd3a42758775b0b8cbd53f89dd23d99ae56a76fa4c13abae3e307c5209ec1edf5a070fddafa9bf6174a0243089bab53fe0c9988ae4b4af2f72f42a2d4e089314
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
02-016.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.unitedfootballcamps.com/bf3/
-
ecatcom.com
-
what3emoji.com
-
primbathandbody.com
-
yt-itclub.com
-
newbieeer.com
-
getyoursofa.com
-
mexicanitems.info
-
catalogcardgames.net
-
leagueofwomengolfers.com
-
gvanmp.com
-
midnightsunhi.com
-
cnluma.com
-
sunsetcherrydesigns.com
-
cosmoproturkey.com
-
inifinityapps.net
-
making50masks.com
-
battalionice.com
-
uk-calculation.net
-
frosteatlove.com
-
bs-mag.com
-
cuisd.life
-
searchlx.com
-
treycorbies.com
-
excellencepi.com
-
4week-keto-results.com
-
rotationdietplan.com
-
chinahousecoralville.com
-
xidao168.com
-
detuimelaar.com
-
fairschedulinglaws.com
-
jinnolouie.com
-
expresslacross.com
-
akealuminum.com
-
madebazar.com
-
phimixx.com
-
jel-tv365.com
-
shakahats.com
-
thabaddieztrap.net
-
petsglorious.com
-
misuperblog.com
-
scorebuddycx.com
-
sgbsmb.com
-
coolbeanstudios.com
-
khitthihonvidai.com
-
myattorneychoicesyoufind.info
-
thenewsdig.com
-
freeuikit.net
-
everydaycollars.com
-
carrerco.com
-
reviewdrkofford.com
-
dragonflyroad.com
-
quinple.com
-
kollektiv.agency
-
cimbank.info
-
productoshealthyandfun.com
-
dovecuwnebawe.com
-
saihohealth.com
-
thehostingroad.com
-
tadalafil.website
-
whereiswillgroup.com
-
ukchealth.com
-
alaskanoddgoods.com
-
praktik-stuff.online
-
gaiactg.com
Targets
-
- Target 02-016.exe
- Size 732KB
- SHA256 fdf3aa0df3a0d4a6d053c55b970ad22f71f5db88f2da4f94bc18f1926b731f1b
- MD5 957014bc66c96533ca3cf65a5b355038
- SHA1 cedbfdb6bd9d4ee9397d2fe0bfab563b01c9ba2a
- SHA512 dd3a42758775b0b8cbd53f89dd23d99ae56a76fa4c13abae3e307c5209ec1edf5a070fddafa9bf6174a0243089bab53fe0c9988ae4b4af2f72f42a2d4e089314
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext