General
- Target 48f264ba784a88ef38095ab61b7caa55.exe
- Size 238KB
- Sample210331-lzpzjs2k7x
- SHA256 5755f598a66b494a7692bfefd7ff348d7d1d8ae6fdd7e799bdfe7f6cbf642c33
- MD5 48f264ba784a88ef38095ab61b7caa55
- SHA1 7ca1fc89acd56f314dae7e8ba0e41227ca342f7d
- SHA512 f02a56ffd4a398983f90f51d5506060ed48f1b6641f56c0480cce124c7520239d03ad9286340a1181ff3b510f4bc866822d33bd1f922673b6ecba2ebbc755fa6
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
48f264ba784a88ef38095ab61b7caa55.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.stockproductionmusic.works/gzh/
-
banken-api.management
-
thecleaningenthusiast.com
-
ytownbbqco.com
-
investmentinsourcing.net
-
naijasm.com
-
224buildingservices.com
-
lossentidosdelatierra.com
-
puntocommx.com
-
grlcgang.com
-
forasacredlife.com
-
travelerglobalexperience.com
-
liquor247usa.com
-
russianfraud.com
-
scarslice.com
-
qiniu-power.com
-
5vid.lat
-
poolotz.com
-
swagychopshop.com
-
0086tcd.com
-
thesaltybetty.com
-
mybirthpillow.com
-
snrinc.com
-
typingtextbooks.com
-
starz4u.com
-
espressokitchenpennhill.uk
-
hovkeydb.com
-
astaxanthinprotectme.com
-
curvemartstore.com
-
intoexile.com
-
thecreditcoach.pro
-
thehealthydessert.com
-
quartzpointgroup.com
-
freisaq.com
-
rrydes.com
-
healthcoverageinpleasanton.com
-
essegi.cloud
-
spartacleaningservices.com
-
smcexpress1.com
-
ramraun.com
-
bigshortlist.com
-
cajunbetter.com
-
wladek.info
-
alinasells.com
-
namedfollows.com
-
darkkitchen.asia
-
bigmoneyblog.club
-
856379985.xyz
-
ctssq.com
-
indigoairtickets.com
-
wrp-holding.com
-
khinenvungtau.com
-
seksva.com
-
raskalnation.com
-
cbluebayvrwdbuy.com
-
erwindefensereviews.com
-
marketersmb.com
-
theposterscouts.com
-
agency-yoshi.com
-
waterkantsuites.net
-
wh551.com
-
amazon-co-jp-er3f.com
-
ldsfortrump.com
-
distingisherod.com
-
homemaderelief.com
Targets
-
- Target 48f264ba784a88ef38095ab61b7caa55.exe
- Size 238KB
- SHA256 5755f598a66b494a7692bfefd7ff348d7d1d8ae6fdd7e799bdfe7f6cbf642c33
- MD5 48f264ba784a88ef38095ab61b7caa55
- SHA1 7ca1fc89acd56f314dae7e8ba0e41227ca342f7d
- SHA512 f02a56ffd4a398983f90f51d5506060ed48f1b6641f56c0480cce124c7520239d03ad9286340a1181ff3b510f4bc866822d33bd1f922673b6ecba2ebbc755fa6
- MD5 SHA1 SHA512
-
Formbook Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext