General
-
Target
9DWvynenEDJ11fY.exe
-
Size
772KB
-
Sample
210503-1t5e45y38a
-
MD5
1b102c40bbd04472fab01210b70d427e
-
SHA1
62d5b8647576f7310743295a295c317e8c9719c7
-
SHA256
d10d943f98bc02f7734f1d61d9b85a0088a3b58886d952e730985861f4e646b6
-
SHA512
e30ad6963c8735c95fe8b8ffd9b011f50cd28f121d5cd9dd2e584c9b9b767e9a96fcd50dca34bdb0bb6d414da4496035fb5288518111e1bab75941f37cbdcfdb
Static task
static1
Behavioral task
behavioral1
Sample
9DWvynenEDJ11fY.exe
Resource
win7v20210410
Malware Config
Extracted
formbook
4.1
http://www.unknowndjteam.com/hsd/
yishi43.com
riseinitiativellc.com
allproparsking.com
janainalimashop.com
artkozijnen.com
1368e.com
gzshengxian.com
tap2.credit
toddmalligan.com
anastasiageorgiou.com
danielamorrowlaw.com
asahipacific.com
quizseeker.com
fayval-williams.com
dreamcatcherrally.com
nuaxbannk.com
presentationmagic.online
signcargo.com
kittyforcupertino.com
danarett.com
otosarjistasyonum.com
hacker78.com
radiancebeautyco.com
technooverhaul.com
madorca.asia
smartcontractvalidate.com
butload.info
studiofitness.club
bk-licht.com
856379589.xyz
haleconstructions.com
6t6bfq6yccpjt8.com
digitalnaturalgas.com
electricidadbielsa.com
nicnoland.com
gis-consultants.com
esotericavenue.com
borderlandindia.com
crowncenturies.com
enginefunds.com
calwestech.com
xenotimes.com
ngul-fo.com
adventuring-allie.com
autosseminuevoshuajuapan.com
hn3488.net
kindlingfires.com
electrumsource.partners
mallorykalleninteriors.com
minemetrix.net
luxbeds.info
thealexandrenola.com
soymono.com
xin-zong.com
zamaleev.com
aglbfm.com
lojalimited.com
atstock.site
ntxfmt.com
chuyensuacuasat.com
floryi.com
foreverandadayphoto.com
hlmediasolutions.com
springbiologicaldentistry.com
Targets
-
-
Target
9DWvynenEDJ11fY.exe
-
Size
772KB
-
MD5
1b102c40bbd04472fab01210b70d427e
-
SHA1
62d5b8647576f7310743295a295c317e8c9719c7
-
SHA256
d10d943f98bc02f7734f1d61d9b85a0088a3b58886d952e730985861f4e646b6
-
SHA512
e30ad6963c8735c95fe8b8ffd9b011f50cd28f121d5cd9dd2e584c9b9b767e9a96fcd50dca34bdb0bb6d414da4496035fb5288518111e1bab75941f37cbdcfdb
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-