General
-
Target
Quotation.exe
-
Size
222KB
-
Sample
210408-b35zeam8ks
-
MD5
1f86caaa19912ceb55c9f6121eb692bb
-
SHA1
2d4dd95fdb17937b22a3d6a41862704ed80acf70
-
SHA256
8309d803c92faaf24828cd67e4c1041f9465ecf6c63f7608d7ed4579f075a02c
-
SHA512
720c68b543c3d5eb2d026feb0ae46d0c77aa0eb71cd3302c520384cbff27e28fed1f9f0b3c761aed7bdea054fd2d3829f294f3250175d6d159d1167122f67a72
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7v20201028
Malware Config
Extracted
formbook
4.1
http://www.riceandginger.com/fcn/
bellee-select.com
unlock-motorola.com
courtneyrunyon.com
hnzywjz.com
retrievingbest.net
ayescarrental.com
beyoutifulblessings.com
heritagediscovery.net
fasoum.com
wbz.xyz
lownak.com
alinkarmay.com
coffeyquiltco.com
validdreamers.com
yuksukcu.club
buildnextfrc.com
avantfarme.com
xyfs360.com
holisticpacific.com
banejia.com
champsn.com
ebitit.com
esseneceedibles.com
findmyautoparts.com
belenusadvisory.net
esrise.net
lovewillfindaway.net
chienluocmarketing.net
greenbelieve.com
shopyourgift.com
theweddingofshadiandmike.com
greenstavern.com
klinku.com
norastravel.com
team5thgroup.com
ohrchadash.com
hauteandcood.com
ap-333.com
jonathantyar.com
robertabraham.com
citestaccnt1597691130.com
665asilo.com
deerokoj.com
ezcovid19.com
heritageivhoa.com
ultraprecisiondata.com
alkiefsaudi.com
camelliaflowers.space
clickqrcoaster.com
ponorogokita.com
stainlesslion.com
china-ymc.com
littner.xyz
houseof2.com
metabolytix.com
1000-help6.club
another-sc.com
suafrisolac.com
whitetreechainmail.com
amazon-service-app-account.com
cruiseameroca.com
yaxett.net
adsmat.com
afternoontravel.site
Targets
-
-
Target
Quotation.exe
-
Size
222KB
-
MD5
1f86caaa19912ceb55c9f6121eb692bb
-
SHA1
2d4dd95fdb17937b22a3d6a41862704ed80acf70
-
SHA256
8309d803c92faaf24828cd67e4c1041f9465ecf6c63f7608d7ed4579f075a02c
-
SHA512
720c68b543c3d5eb2d026feb0ae46d0c77aa0eb71cd3302c520384cbff27e28fed1f9f0b3c761aed7bdea054fd2d3829f294f3250175d6d159d1167122f67a72
-
Formbook Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-