General
-
Target
Xerox Scan_07122020181109.exe
-
Size
548KB
-
Sample
210430-6rztnz8jrx
-
MD5
d32b16a8b624da8d210ed2df4f01a360
-
SHA1
92cc60c1ab97e7d0b4b5c9ff82c5e6b4bee26ee0
-
SHA256
e338687d4f9f5fe40129cd2def9a200b463f85e406b093b4334322bea48baa3a
-
SHA512
40c9c501ecb839e4c33d7a968a4759d5fa599a6da5e49f26f1f6f7d96c400bbef4db3de1b4f7e3c301a428ee5e1345c86df82b3f9a38cd48850c8a41b0b750f7
Static task
static1
Behavioral task
behavioral1
Sample
Xerox Scan_07122020181109.exe
Resource
win7v20210410
Malware Config
Extracted
formbook
4.1
http://www.monsunconsulting.com/gnf/
phongthuythienan.website
andreaknightteacherauthor.com
lifeswatercolors.com
572215.com
kolm-polymers.com
turkishmarket.guru
jonnybravoarmory.com
wedatseasonings.com
worstdread.com
arisealf.com
gpsemployerservices.com
glorybit.com
purposeprowrestling.com
funlifecycle.com
bprattservices.com
pumpkinpundit.com
kustomhydraulics.com
accounteyei.com
visionagny.com
iddomum.com
glamourthailand.com
dbotblemxpzvw.com
jack2design.com
52wanlol.com
brightwoodcollection.com
gerbangadab.com
raffou.com
yiliclean.com
hous12.com
himalayancorridors.com
brad-caroline.com
zaborniaks.com
dawdwad001.com
xn--ye-ea-mender-dhb.com
kisshairstudio.com
2setai-jutaku.info
z0170.com
biodidet.com
nelivo.com
mtchildcareprovider.com
taolin8.com
ventadepelo.com
helenatemporaryhousing.com
chelsealaneacting.com
bacongrinder.com
excellencewellfaresociety.com
sifioaifdvjieevd.info
outliercity.com
supmomma.com
boatmanagementspecialist.com
moonstonelanka.com
smartraining.info
snappygarden.com
thecollectionbybk.com
vipbeautyconcept.com
safetubusa.com
hi5mgdev.com
taurean-designs.com
midasbienesraices.com
willysuegardens.com
bluebayvrwdshop.com
hotjennyjones.com
fibropil.com
staveoffboredom.com
Targets
-
-
Target
Xerox Scan_07122020181109.exe
-
Size
548KB
-
MD5
d32b16a8b624da8d210ed2df4f01a360
-
SHA1
92cc60c1ab97e7d0b4b5c9ff82c5e6b4bee26ee0
-
SHA256
e338687d4f9f5fe40129cd2def9a200b463f85e406b093b4334322bea48baa3a
-
SHA512
40c9c501ecb839e4c33d7a968a4759d5fa599a6da5e49f26f1f6f7d96c400bbef4db3de1b4f7e3c301a428ee5e1345c86df82b3f9a38cd48850c8a41b0b750f7
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-