General
- Target Purchase Order 2021 - 00041.exe
- Size 911KB
- Sample210324-7rhdga1e5e
- SHA256 8afb80762bc90479ba2d8f4237e755f78ea789601781615088dfa52f3e87d72a
- MD5 8844321c19344ef5bec73e5a3c073a89
- SHA1 3273ed451bf3d65cdf4f20ffa28bf9b656ddf431
- SHA512 2a8e514f82241d80a5910272e572410d1b4b9f4ff3cff2b43f4166176ccbfa14a261eb72009c3fd90ca71bf9599f5e71c8e7e269274dd5c7d295e77451ef62b3
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 2021 - 00041.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.otokoikon.com/vsk9/
-
545earth.com
-
womandigitalrights.net
-
tczxsjw.com
-
tuvantuyensinh24h.com
-
augiocxqo.icu
-
textingtexan.com
-
cheaperwhere.com
-
owe.pink
-
canzonianni90.com
-
explorehisword.com
-
alexaglobe.com
-
comharbookkeeping.com
-
insportseurolatam.com
-
rockplaylists.com
-
masqueareas.com
-
peixunzx.com
-
loudmouse-ent.com
-
medtopharma.com
-
jokersupadte.com
-
axsm0815.com
-
mmc-mybox.com
-
atxrvrepair.com
-
homesecuritymx.site
-
cubekwt.com
-
clouddevopsteam.tech
-
qm7886.com
-
sweet-day.net
-
fzgdrzdb.com
-
automaticdataprocessing.sucks
-
homestylebutque.com
-
leonelorrala.com
-
accupi.com
-
kkkstuff4sale.com
-
greatskydroneservice.com
-
gutlabsllc.com
-
buildecks.com
-
watdomenrendi02.com
-
petrahappycorner.club
-
ht8957.com
-
billygoatoffroad.com
-
rebelblk.com
-
simplyshields.com
-
communal-sleeve.net
-
spiritualflava.com
-
arjservicos.com
-
neighborlyrepair.com
-
sheboyganshore.com
-
officialrichminds.com
-
flyolaairambulance.com
-
panicpillow.com
-
xn--6p1awe.club
-
902444444.net
-
bkgexqjg.icu
-
intothesean.com
-
atualizacao.net
-
conversenglish.com
-
skiphire-wolverhampton.com
-
jumlasx.xyz
-
loanhelpservices.com
-
chpcorporation-product.com
-
sixpackabstactics.com
-
esearsk.icu
-
llseatac.com
-
puckerandwinkbeauty.com
Targets
-
- Target Purchase Order 2021 - 00041.exe
- Size 911KB
- SHA256 8afb80762bc90479ba2d8f4237e755f78ea789601781615088dfa52f3e87d72a
- MD5 8844321c19344ef5bec73e5a3c073a89
- SHA1 3273ed451bf3d65cdf4f20ffa28bf9b656ddf431
- SHA512 2a8e514f82241d80a5910272e572410d1b4b9f4ff3cff2b43f4166176ccbfa14a261eb72009c3fd90ca71bf9599f5e71c8e7e269274dd5c7d295e77451ef62b3
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext