General
- Target REQUEST FOR QUOTATION.exe
- Size 639KB
- Sample210402-b85mfs63b6
- SHA256 5aa64b3eef03b9c837e37102be20cb4f537c524b2a2531bf1bf6dd6a02461d7e
- MD5 5856cf17f0da125336f20a5a4fae5121
- SHA1 3998d8651f6a07c33ba730fcee7f0e689b962e6c
- SHA512 5d84dde720c87b530c191a93d2f01f2c64010d2536b55977f9220bf2f43325fd1bef35fbd972449e5027b3d616f52e91cb54c083f88d27307607e90c09dfaba9
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
REQUEST FOR QUOTATION.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.riceandginger.com/fcn/
-
bellee-select.com
-
unlock-motorola.com
-
courtneyrunyon.com
-
hnzywjz.com
-
retrievingbest.net
-
ayescarrental.com
-
beyoutifulblessings.com
-
heritagediscovery.net
-
fasoum.com
-
wbz.xyz
-
lownak.com
-
alinkarmay.com
-
coffeyquiltco.com
-
validdreamers.com
-
yuksukcu.club
-
buildnextfrc.com
-
avantfarme.com
-
xyfs360.com
-
holisticpacific.com
-
banejia.com
-
champsn.com
-
ebitit.com
-
esseneceedibles.com
-
findmyautoparts.com
-
belenusadvisory.net
-
esrise.net
-
lovewillfindaway.net
-
chienluocmarketing.net
-
greenbelieve.com
-
shopyourgift.com
-
theweddingofshadiandmike.com
-
greenstavern.com
-
klinku.com
-
norastravel.com
-
team5thgroup.com
-
ohrchadash.com
-
hauteandcood.com
-
ap-333.com
-
jonathantyar.com
-
robertabraham.com
-
citestaccnt1597691130.com
-
665asilo.com
-
deerokoj.com
-
ezcovid19.com
-
heritageivhoa.com
-
ultraprecisiondata.com
-
alkiefsaudi.com
-
camelliaflowers.space
-
clickqrcoaster.com
-
ponorogokita.com
-
stainlesslion.com
-
china-ymc.com
-
littner.xyz
-
houseof2.com
-
metabolytix.com
-
1000-help6.club
-
another-sc.com
-
suafrisolac.com
-
whitetreechainmail.com
-
amazon-service-app-account.com
-
cruiseameroca.com
-
yaxett.net
-
adsmat.com
-
afternoontravel.site
Targets
-
- Target REQUEST FOR QUOTATION.exe
- Size 639KB
- SHA256 5aa64b3eef03b9c837e37102be20cb4f537c524b2a2531bf1bf6dd6a02461d7e
- MD5 5856cf17f0da125336f20a5a4fae5121
- SHA1 3998d8651f6a07c33ba730fcee7f0e689b962e6c
- SHA512 5d84dde720c87b530c191a93d2f01f2c64010d2536b55977f9220bf2f43325fd1bef35fbd972449e5027b3d616f52e91cb54c083f88d27307607e90c09dfaba9
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext