General
- Target confirm this order and sign PI.gz
- Size 715KB
- Sample210426-ct59vpvb4x
- SHA256 bc429aca6dcf6a9b2315f7cdf4465ceb8a4f5ded220c7c6ef2c6781d5d5dafc4
- MD5 299e8942daf3479234843c5327676e5e
- SHA1 e00bd102794e443be8be1335cbd8e8a39b86d192
- SHA512 16f04f0b636d83531c282f80a31dff52c57137b2e6ffabc39ca89ddcfe9fc47c84409d2c868b3951564215bbf2bac78161219339b31430a98a670fbab1e0002d
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
confirm this order and sign PI.exe
Resource
win7v20210410
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.magnumopuspro.com/nyr/
-
anemone-vintage.com
-
ironcitytools.com
-
joshandmatthew.com
-
breathtakingscenery.photos
-
karabakh-terror.com
-
micahelgall.com
-
entretiendesterrasses.com
-
mhgholdings.com
-
blewm.com
-
sidewalknotary.com
-
ytrs-elec.com
-
danhpham.com
-
ma21cle2henz.xyz
-
lotusforlease.com
-
shipleyphotoandfilm.com
-
bulktool.xyz
-
ouedzmala.com
-
yichengvpr.com
-
connectmygames.com
-
chjcsc.com
-
dope-chocolate.com
-
tacowench.com
-
projectsbay.com
-
xn--pgboc92d.com
-
royaldropofoil.com
-
ranguanglian.club
-
mobilne-kucice.com
-
buytsycon.com
-
goiasbets.net
-
blpetroleum.com
-
starrealms.net
-
exclusiveflooringcollection.com
-
kudalive.com
-
tienda-sky.com
-
drillinginsider.info
-
theglasshousenyc.com
-
vietnammoi.xyz
-
walterbenicio.com
-
zoomtvliveshows.xyz
-
boujiehoodbaby.com
-
yzyangyu.com
-
exploreecetera.com
-
sycord.com
-
waykifood.com
-
shadingconsultancy.com
-
precedentai.net
-
linhanhkitchen.com
-
expekt24.com
-
socialdating24.com
-
lubvim.com
-
floryi.com
-
alerist.com
-
maluss.com
-
hitbbq.com
-
alerrandrotattoo.com
-
algoplayer.com
-
idahooutsiders.com
-
qygmuakhk.club
-
neverpossible.com
-
winparadigm.com
-
toughdecorative.com
-
yourbuildmedia.com
-
summercrowd.com
-
josemvazquez.com
Targets
-
- Target confirm this order and sign PI.exe
- Size 1.1MB
- SHA256 f6b1a22c0cfc0c363bb163b7bd3236ee1dac2995a3511a6a941b7a7af656ba25
- MD5 8f929ce8e5e81287ceb254ce65efb2b4
- SHA1 b37fb3bfb9033a0d04189e5913159fe49a339828
- SHA512 ff4cbe38f5bca7b9e0c1ea9a5338d308c160211faa51d84beada8d8c29f4ad4f3f9fb9377c74a76ad5d56a51ef80ef678e1f07a8f4fb8aa083b35b654dc5e303
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext