General
- Target Payment Transfer Copy of $274,876.00 for the invoice shipments.exe
- Size 699KB
- Sample210223-a7esjef5lx
- SHA256 5d5d64a87a5d888443e8d7a25046922fa4a39fe5952a45635dd66321e616bb14
- MD5 5f1c9c4a7bc24c3d39a5a3834ba7bb8e
- SHA1 0e9a21a75675c636438f50d90bb5f7ec9a689275
- SHA512 a85b3076ee72e71532e60d84e6827b6c83ddaa2b1f0b287fac373eff495f67600a4e8d47459c6253538f0d9d770c004f41833e75d630d12047442ed3a9033894
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Payment Transfer Copy of $274,876.00 for the invoice shipments.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.jaemagreci.com/blr/
-
cvmjqcid.com
-
cubskw.com
-
carbeloy.com
-
lucascolterneal.com
-
robertlainstrom.com
-
long9000.com
-
drtconseils.com
-
keptus.com
-
mediamonkeyhouse.com
-
outletmihotel.com
-
exchangemailboxrepair.com
-
kanaai.com
-
mountshastajerky.com
-
thepettybox.com
-
sweetpopntreatz.com
-
wpweasel.com
-
plumbersinauckland.com
-
sevdaduragi.com
-
gesunde-ordnung.com
-
10751wilshire801.com
-
brandmkttx.net
-
yoshiyama-potager.com
-
na230.com
-
kittyninja.net
-
eurythmy.net
-
circlecitydesign.com
-
thesleepinn.com
-
olgadalila.com
-
happyaiper.com
-
supplierdurian.site
-
simplymcs.com
-
ug-storecards.com
-
gannahealing.com
-
ginamoney.com
-
emilyadkinsonrealtor.com
-
tablatiffin.com
-
laughinggrassfarm.com
-
thebriartowns.com
-
youplus.website
-
soheilvaseghi.com
-
prodhealth.site
-
bltck.com
-
zomapa.com
-
hcssgy.com
-
simplyloveoccasions.com
-
mdglitzallstars.com
-
rck.xyz
-
stanchilo.com
-
avadl.pro
-
astursuites.com
-
whowetrust.com
-
easpipe.com
-
ortopediagalvao.com
-
wellhealt.com
-
destinyhouseacton.com
-
lazyturtletikibar.com
-
online-verifieren.net
-
jasa-software.com
-
tenager365.com
-
atgiven.icu
-
recette-originale.com
-
danielleandnic.com
-
kathrynbaierling.com
-
emmaxbellecandleco.com
Targets
-
- Target Payment Transfer Copy of $274,876.00 for the invoice shipments.exe
- Size 699KB
- SHA256 5d5d64a87a5d888443e8d7a25046922fa4a39fe5952a45635dd66321e616bb14
- MD5 5f1c9c4a7bc24c3d39a5a3834ba7bb8e
- SHA1 0e9a21a75675c636438f50d90bb5f7ec9a689275
- SHA512 a85b3076ee72e71532e60d84e6827b6c83ddaa2b1f0b287fac373eff495f67600a4e8d47459c6253538f0d9d770c004f41833e75d630d12047442ed3a9033894
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext