General
- Target supporting documents.exe
- Size 927KB
- Sample210312-fsq73s1trs
- SHA256 f39b9e8c4a9aa6d8cd9f069e8a8ee81a3f666e07071f2b4673aa42633026736c
- MD5 ea4e28ba48205647ea5c50b9767dcaf7
- SHA1 893da1c93ba0ac1edc4d856712d27edb42594daa
- SHA512 46df3fcdd5b8663eb82d295c24baff49535573af3c5d9b0192be7f622cf5a99f0cd11d374c6f7d1b469577084d4e167085d6f1e4b5aa2072aff42e0f7064035c
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
supporting documents.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.the-techs.info/chue/
-
wowmovies.today
-
magentos6.com
-
bi-nav.com
-
atlantahawks.sucks
-
wluabjy.icu
-
kevableinsights.com
-
lavidaenaustralia.com
-
stonermadeapparel.net
-
sondein.com
-
cirquedusoleilartist.com
-
kanjitem.com
-
tomofalltrades.site
-
mecanico.guru
-
tech2020s.com
-
amesoneco.com
-
theawfulliar.com
-
californiaadugurus.com
-
rentalservicesolutions.com
-
fsxbhd.club
-
casino-seo.com
-
asknesto.com
-
get-rangextd.com
-
gkwill.com
-
juliegiles.net
-
pagosafreedom.com
-
wbpossiblellc.com
-
fhjfyutotyhfse.com
-
sexshopsatelite.com
-
shellykraftlaw.com
-
motherhenscoop.com
-
mboklanjar.com
-
redwoodcityswing.com
-
haier-mz.com
-
metalinjectionltd.asia
-
franquiaoriginal.com
-
mcronaldfood.com
-
mobilegymconcierge.com
-
haifu168.com
-
apeiro.life
-
thejosephnashvilletn.com
-
bensbrickstore.com
-
sanctumwell.com
-
beanexthomie.com
-
stylazhaircare.com
-
jordanvanvleet.com
-
jdwx400.com
-
francescoricco.com
-
gameshowsatschool.com
-
alqymist-monaco.com
-
infinitysportsmassage.com
-
algorithmrecruitment.com
-
tanyasubatang.com
-
impressivebackyard.com
-
wwwgocashwire.com
-
visual-pioneers.net
-
thememo-mobilebar.com
-
wagner-fahrschulegmbh.com
-
minterfortexas.com
-
codelopers.com
-
inyarsb.icu
-
ravenlightproductions.com
-
germiblock.com
-
coutinhoefelipeadv.com
-
diegobr1307.life
Targets
-
- Target supporting documents.exe
- Size 927KB
- SHA256 f39b9e8c4a9aa6d8cd9f069e8a8ee81a3f666e07071f2b4673aa42633026736c
- MD5 ea4e28ba48205647ea5c50b9767dcaf7
- SHA1 893da1c93ba0ac1edc4d856712d27edb42594daa
- SHA512 46df3fcdd5b8663eb82d295c24baff49535573af3c5d9b0192be7f622cf5a99f0cd11d374c6f7d1b469577084d4e167085d6f1e4b5aa2072aff42e0f7064035c
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext