General
- Target INV-210318L.exe
- Size 458KB
- Sample210401-69pfe1c5xn
- SHA256 6c2f5bf673b3bbc31cf425259cd5a0262094e85a8bed03714c7b39712efc4beb
- MD5 38e46988023b026e0553c165e5b21c4c
- SHA1 e20d2a8861010eec859348a95b091b894ba638e2
- SHA512 5c86b482585be4b7349fbedeffde962bee0f1ccb591f430b199a69451f5a82c66cafc20eab9e9ba874ebb6b7c5ffebcd696abaf0dc7922685fb2960878f95490
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
INV-210318L.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.otokoikon.com/vsk9/
-
545earth.com
-
womandigitalrights.net
-
tczxsjw.com
-
tuvantuyensinh24h.com
-
augiocxqo.icu
-
textingtexan.com
-
cheaperwhere.com
-
owe.pink
-
canzonianni90.com
-
explorehisword.com
-
alexaglobe.com
-
comharbookkeeping.com
-
insportseurolatam.com
-
rockplaylists.com
-
masqueareas.com
-
peixunzx.com
-
loudmouse-ent.com
-
medtopharma.com
-
jokersupadte.com
-
axsm0815.com
-
mmc-mybox.com
-
atxrvrepair.com
-
homesecuritymx.site
-
cubekwt.com
-
clouddevopsteam.tech
-
qm7886.com
-
sweet-day.net
-
fzgdrzdb.com
-
automaticdataprocessing.sucks
-
homestylebutque.com
-
leonelorrala.com
-
accupi.com
-
kkkstuff4sale.com
-
greatskydroneservice.com
-
gutlabsllc.com
-
buildecks.com
-
watdomenrendi02.com
-
petrahappycorner.club
-
ht8957.com
-
billygoatoffroad.com
-
rebelblk.com
-
simplyshields.com
-
communal-sleeve.net
-
spiritualflava.com
-
arjservicos.com
-
neighborlyrepair.com
-
sheboyganshore.com
-
officialrichminds.com
-
flyolaairambulance.com
-
panicpillow.com
-
xn--6p1awe.club
-
902444444.net
-
bkgexqjg.icu
-
intothesean.com
-
atualizacao.net
-
conversenglish.com
-
skiphire-wolverhampton.com
-
jumlasx.xyz
-
loanhelpservices.com
-
chpcorporation-product.com
-
sixpackabstactics.com
-
esearsk.icu
-
llseatac.com
-
puckerandwinkbeauty.com
Targets
-
- Target INV-210318L.exe
- Size 458KB
- SHA256 6c2f5bf673b3bbc31cf425259cd5a0262094e85a8bed03714c7b39712efc4beb
- MD5 38e46988023b026e0553c165e5b21c4c
- SHA1 e20d2a8861010eec859348a95b091b894ba638e2
- SHA512 5c86b482585be4b7349fbedeffde962bee0f1ccb591f430b199a69451f5a82c66cafc20eab9e9ba874ebb6b7c5ffebcd696abaf0dc7922685fb2960878f95490
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext