General
- Target Invoicee.exe
- Size 511KB
- Sample210408-pr7qd72v6e
- SHA256 9b9218d3692f38654cde45d5a9b01a6d5cb83aa5442c286fc4e073a6348e08d1
- MD5 1832c0cee417fe037896caea05871046
- SHA1 99b409f1d4eb642ab2d09f46ae4fd8d98292f8e6
- SHA512 094a9d0390bd9f1f0a1c5c7b955d58b933d0e64f75d109238ec62a6dd173ebfcdfc7000ca1ee3390928551f6a627df124a9154e21f9d30c5c9be3dadadef8d8c
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Invoicee.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.boldoval.com/ch65/
-
jobhuizhan.com
-
madeinarcade.com
-
germanyromeo.club
-
gsxguru.com
-
widedepot.com
-
aboutthemwheels.com
-
roboticmarkets.com
-
triy.club
-
primetrust.foundation
-
raulmendez.design
-
reddingvideos.com
-
cyclingsunglassestrend.com
-
sacredstarmystic.com
-
juxrams.info
-
multacolors.com
-
focusonevolving.com
-
kimmoniqueboutique.com
-
palomadepapel.com
-
stanleywatches.com
-
lafamiliagomez.com
-
sukatalde.com
-
champetonline.com
-
projectweho.com
-
wajeovcoo.com
-
arcticblastairheat.com
-
makeuptipsonline.com
-
lovelessons102.com
-
hastibaba.com
-
wg226.com
-
artista.digital
-
atelier9.info
-
successpuntocom.com
-
miningtradefast.com
-
amazonaonlineact.com
-
rockospizzaforney.com
-
sosyalduvar.com
-
trueutility.net
-
jwkk86.com
-
easyfreedomlifestyle.com
-
lightstailor.com
-
theflightcap.com
-
doculinc.com
-
shahzor30.com
-
chadsautocare.com
-
damonneutzling.com
-
bestsellngus.com
-
myseedsmenu.com
-
sanfordfinancialsolutions.com
-
circlecandles.com
-
madeinsusanville.com
-
artistmaecenas.com
-
sihilanimalhealth.com
-
wildnectarlandscaping.com
-
smoothmediadesigns.com
-
debarillas.com
-
francesexeshop.com
-
hphometeam.com
-
corpverify.com
-
justtop5.com
-
jeeljadeed.com
-
findyourxmg.com
-
winewhinegirls.com
-
thelettucelady.com
-
tango-akademie.com
Targets
-
- Target Invoicee.exe
- Size 511KB
- SHA256 9b9218d3692f38654cde45d5a9b01a6d5cb83aa5442c286fc4e073a6348e08d1
- MD5 1832c0cee417fe037896caea05871046
- SHA1 99b409f1d4eb642ab2d09f46ae4fd8d98292f8e6
- SHA512 094a9d0390bd9f1f0a1c5c7b955d58b933d0e64f75d109238ec62a6dd173ebfcdfc7000ca1ee3390928551f6a627df124a9154e21f9d30c5c9be3dadadef8d8c
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext