General
- Target PO_210311.exe
- Size 691KB
- Sample210311-kth6yfdncx
- SHA256 cccbd0b2d46adeb6d99413af4d5a4492cd530922a09724f04c8fb1e0c47d8326
- MD5 be9b6d1c5ffc650c7d7c41c657d406ee
- SHA1 52f566308b1a9382de699c72a35605d6f985a235
- SHA512 6ad8abf9f38230f0d2a3e15f805ab5ecabc9839437294f7603a769c645b15931b7d120aba28fe7140ae404fa4ece6c0ae3650b181c1a5b0cb6efabea143e9b4b
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
PO_210311.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.avonvalleycollege.com/kbc/
-
ross76.com
-
modabyboutique.com
-
zenabode.store
-
peakorgmush.net
-
superchargelab.com
-
mumaniu.net
-
18costleyst.com
-
moreroomy.com
-
creativecardsnappanee.com
-
jameshamiltonphoto.com
-
amimania.com
-
ahaihealing.com
-
thecopy.coach
-
caishen2587.com
-
bigdickquick.com
-
suojincn.com
-
2020rl.com
-
jointbah.com
-
teddingtonstudios.com
-
javre.club
-
staytonhigh.com
-
werunthebases.net
-
cuoisangkhoai.com
-
tamikastevenson.com
-
deintuning.com
-
lookingforsolution.net
-
elmejorsetup.com
-
aprobet43.xyz
-
qbluebaylivewd.com
-
orbitnest.com
-
notitlement.net
-
fordagelijkse-aanbiedingen.com
-
e-lsolar.com
-
soulstartuphub.com
-
jeetinternationalgroup.com
-
juduojiapinpdd.com
-
obellegrande.com
-
wordsmithmridgandha.com
-
bumpgrandma.com
-
jordanmatrimony.com
-
sansarhome.com
-
xn--hurryet-bza.com
-
skatinggoosefarm.com
-
10erres.com
-
cleopatrasormus.com
-
vidacomdeus.life
-
yeasuc.com
-
soleymaniha.com
-
assistedlivingarcadia.com
-
grouphall.net
-
kinect.solar
-
accidentify.com
-
jaya.asia
-
pwrenn.com
-
rainbowhealingandwellness.com
-
streminglive24.xyz
-
fiercegracecounseling.com
-
7ba3.com
-
cherryhillimmigrationlawyer.com
-
melsquirkycorner.com
-
bihartaxi.com
-
crossfitverstas.com
-
dungouquan.com
-
homeownerdefenders.com
Targets
-
- Target PO_210311.exe
- Size 691KB
- SHA256 cccbd0b2d46adeb6d99413af4d5a4492cd530922a09724f04c8fb1e0c47d8326
- MD5 be9b6d1c5ffc650c7d7c41c657d406ee
- SHA1 52f566308b1a9382de699c72a35605d6f985a235
- SHA512 6ad8abf9f38230f0d2a3e15f805ab5ecabc9839437294f7603a769c645b15931b7d120aba28fe7140ae404fa4ece6c0ae3650b181c1a5b0cb6efabea143e9b4b
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext