General
-
Target
Passport_ID_jpg.exe
-
Size
657KB
-
Sample
210421-vf71brk17s
-
MD5
6b095bd38143e9308e9ffca16b2a5bff
-
SHA1
0fdd73e4020f6c1e5a3482659bae46bd5d47d8e2
-
SHA256
2fcd9b75bc8b3443e1196faca6b458d8caeaa213b19dd5e5ee78ae559962aa9c
-
SHA512
6be73b32e7b6244d1b90a7a81acb0a3df84166b0ac863355f5c9f8c2608bbb9e9bd620993a0e019d6a14dafd923d7036d563289bba18d15b40ec4535aaa721dc
Static task
static1
Behavioral task
behavioral1
Sample
Passport_ID_jpg.exe
Resource
win7v20210408
Malware Config
Extracted
formbook
4.1
http://www.simplymollie.com/sre/
pasionmusical.com
csgoplays.com
donnabsringsblingandthings.com
renovation-mansion.com
stoneswithsouls.com
ibworm.net
solidwin88bet.com
vtnywvebg.club
buyyourhd.com
reviewit4you.com
tobethelion.com
venicegifts.com
tyronredman.com
peloponnesesunbed.com
atranscom.com
flexi-rentals.com
neilint.com
brmsempire.com
maisquebolsas.com
hack-cloud.icu
milestone-dental.com
loolebazkonkaraj.com
floryi.com
brokod.com
5151gt.com
webblad.info
usluke.com
londonshard.com
russkoe.love
vigilanciabogota.com
yikouxiu.com
dleonisa.com
davidjosephbooks.com
rustyrobinsonfuturend.com
llttfsuffolk.com
project-dashboard.online
wikiliberty.com
fourthwalldiagnostics.com
qsgongkong.com
zhenshigoods.com
soukt.com
annahopkinsonart.com
dynamicprocleaning.com
nickwestspanglish.com
photovideobg.com
thesprktmbrand.com
guangdongmansion.com
huevnvideo.com
psychologist-help.com
jstool-korea.com
balbidumco.com
deviantort.com
andrewcurtis.net
bdsm-kontakt.net
refineproskin.com
devo-denz.com
unitedcreed.net
fengwujiu.ltd
7muz7epekpmw92.net
gbdodgeball.com
gumysle.info
blackdoorsociety.com
picmomentscancun.info
wisdomoftheowl.com
Targets
-
-
Target
Passport_ID_jpg.exe
-
Size
657KB
-
MD5
6b095bd38143e9308e9ffca16b2a5bff
-
SHA1
0fdd73e4020f6c1e5a3482659bae46bd5d47d8e2
-
SHA256
2fcd9b75bc8b3443e1196faca6b458d8caeaa213b19dd5e5ee78ae559962aa9c
-
SHA512
6be73b32e7b6244d1b90a7a81acb0a3df84166b0ac863355f5c9f8c2608bbb9e9bd620993a0e019d6a14dafd923d7036d563289bba18d15b40ec4535aaa721dc
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-