General
- Target Additional DHL shipment Delivery Parcel.exe
- Size 510KB
- Sample210226-2tyh2pa522
- SHA256 b5ac8902c4d239f5f72366876e99a586d3aaafe45c9a9e098c8ded9a2db7615c
- MD5 b2fd9aab2f1597f74abda918ddc52f89
- SHA1 acdf16e4c3a8e0428f7cf1934fdcfe0731b2fc28
- SHA512 3297c94b09f6845905f621020821c0ae05a95a0c4e96436f57460aeae5786e7be3acf1d159a0b2282636e2d765715d8d4242be80cfa549fa5d301d05baa175ff
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Additional DHL shipment Delivery Parcel.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.webperb.com/nehc/
-
havenmaple.com
-
katrinasmarket.com
-
ccharlet.com
-
everestmedicalgroupusa.net
-
powervoc.com
-
crypto300cluv.com
-
davidrichterlaw.com
-
parkcitysongfest.com
-
videogeniusawards.com
-
beleave.club
-
gooddeedprocessing.com
-
synthsup.com
-
eceiptsworld.com
-
infinityanalytics.co.uk
-
damghair.com
-
sabaidate.com
-
guitarsir.com
-
thebowlingspot.com
-
denturelabmiami.com
-
mo-cooking.com
-
eronbon.com
-
appleunveils.com
-
gelisim-elektronik.com
-
cardinalvaletlax.com
-
ehot-tech.com
-
boefem.com
-
milliemaiden.com
-
phoenixpure.net
-
versalita.net
-
avon.sucks
-
larutasustentable.com
-
townleolawi.com
-
hyejeongfood.com
-
strategrowth.com
-
twofiveninetwo.com
-
bymirzaoglu.com
-
centrodesaludcrecer.com
-
pensacolahandymanservices.com
-
march.wtf
-
layer.icu
-
sweetpeamagnoliaco.com
-
palaceelysee.website
-
silkayra.com
-
integratednourishment.com
-
eitalasqueira.com
-
edfenr-invest.com
-
rezervacnisystem.online
-
viassoft.com
-
sfmfm.com
-
sangharshbharatnews.com
-
underdessous.com
-
luisxe.info
-
eliveyeyn.com
-
lavesteenjean.com
-
h2oworks.net
-
imtheonlyperson.technology
-
premoo.com
-
weareprof.com
-
newcotechnology.com
-
monnaisjouetsherbrooke.com
-
juegoroblox.com
-
ryacorcosquin.com
-
livetechstop.com
-
hnuman.com
Targets
-
- Target Additional DHL shipment Delivery Parcel.exe
- Size 510KB
- SHA256 b5ac8902c4d239f5f72366876e99a586d3aaafe45c9a9e098c8ded9a2db7615c
- MD5 b2fd9aab2f1597f74abda918ddc52f89
- SHA1 acdf16e4c3a8e0428f7cf1934fdcfe0731b2fc28
- SHA512 3297c94b09f6845905f621020821c0ae05a95a0c4e96436f57460aeae5786e7be3acf1d159a0b2282636e2d765715d8d4242be80cfa549fa5d301d05baa175ff
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext