General
- Target Material Requisition for Quotation (MRQ).exe
- Size 222KB
- Sample210414-7dbx9rf7ra
- SHA256 8f6fcbc62fb32a19196119ccaa6e45a5eabb8ed2aad233e5ea910dd3e6bde421
- MD5 44f51b05e32203404ca4924cd22e1740
- SHA1 f57f9bf884cef6f79427c49248e88b739fe98aab
- SHA512 aac247337060c3a4a77cb0e38befd3422e4d9e49be3fea12b0eb147b312f7e314fecbd09d4c175f9de08c1813366d81b53c63ee713e908b0f0edbab32c06cd83
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Material Requisition for Quotation (MRQ).exe
Resource
win7v20210410
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.tiktokblueprints.com/ea9e/
-
yoga-fertilite.com
-
zcltlfsh.icu
-
aberdareroyalcottages.com
-
kawaiibobateahouse.com
-
311gang.com
-
coastalbreezecreations.com
-
globosimpresoss.com
-
ignitioniq.com
-
5gplaystation.com
-
marketopiniononline.com
-
martinstantondesigns.com
-
ksdhxtkpup4.net
-
findconscious.com
-
pure-tab.com
-
orderanthonysofskippack.com
-
findingthecurve.com
-
e-devletim.com
-
prosystemwebsite.com
-
travelbroom.com
-
sharpopinion.com
-
musclebuildingschool.com
-
prochoice-limo.com
-
xxgjmall.com
-
spoiltgirl.com
-
carpetcleaningmeridian.com
-
robertomiceli.com
-
leqi166.com
-
kaloncosmetx.com
-
siheontech.com
-
zunoki.com
-
egohui.pro
-
singjolt.com
-
shiqiangjn.com
-
ideaofis.com
-
wallet-invest.com
-
suitsnladders.com
-
pleasanthomestay.com
-
gametrue.online
-
sufferer-uncontroverted.info
-
riversidecahomes.com
-
kjfuli8.com
-
hottype.xyz
-
7958699.com
-
tijebei.com
-
animef.net
-
miraterratravel.com
-
lyon-de.com
-
psm-gen.com
-
discoveryaccess.xyz
-
nails-und-beauty.com
-
perfectkode.com
-
bieniek.one
-
1933ejaniceway.com
-
scholarlyleadership.com
-
alpinefloristnj.com
-
gsbkdz.com
-
vidtutor.com
-
willflosolutions.com
-
solongastheyfear.com
-
nexi-id.info
-
msglowrca.com
-
ulubeyismerkezi.com
-
valhallastables.net
-
coreadvices.com
Targets
-
- Target Material Requisition for Quotation (MRQ).exe
- Size 222KB
- SHA256 8f6fcbc62fb32a19196119ccaa6e45a5eabb8ed2aad233e5ea910dd3e6bde421
- MD5 44f51b05e32203404ca4924cd22e1740
- SHA1 f57f9bf884cef6f79427c49248e88b739fe98aab
- SHA512 aac247337060c3a4a77cb0e38befd3422e4d9e49be3fea12b0eb147b312f7e314fecbd09d4c175f9de08c1813366d81b53c63ee713e908b0f0edbab32c06cd83
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext