General
- Target Quotation.exe
- Size 955KB
- Sample210506-6prpa16v36
- SHA256 49a4412c27e5eafc4c4365a2b2aeb962d6bf25849ab58d4e7eeb25fcfb934dcd
- MD5 9246a29da060479960879de3db2f1374
- SHA1 fecbed5c0e6cce40444994c85caf7cb838b35df7
- SHA512 d463a62e867e1b64e1a0fa22583840f6198b8af9e7cafbf6608da726fb94d66184c5abf172c150513a48ea09711633847e429b50bd3d0df09f5168799c640d7f
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7v20210410
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.bluesmartsockets.com/mgl/
-
credittipswebinar.com
-
pewpewlab.com
-
teamcreativconsultanting.com
-
bsf.xyz
-
youthwork.support
-
fmoues.com
-
ourcardoctor.com
-
wwwmoticarshub.net
-
bellevuedogroomer.com
-
vorazshop.com
-
sorteo.gratis
-
shalinihome.xyz
-
myschoolmgt.net
-
we73theunityprojectband.com
-
xn--n8jx07hkhe20b9k751g.com
-
gregrunnebaum.com
-
asnomayritys.com
-
iremgulmez.com
-
the1099guy.com
-
reviewscandy.net
-
reliableservicing.net
-
flowerscarpet.com
-
farmacyaustralia.com
-
chaytel.com
-
tslcreativearts.com
-
leather-metal.com
-
nella2matteo.com
-
amazingcoffee.club
-
rideonrenlo.com
-
pgmbin.com
-
handymanfromusa.com
-
medicalproductanimator.com
-
slmgtq.com
-
leamuratingles.com
-
funservicesfl.com
-
hyundaipartsdealsucks.com
-
edsportin.com
-
squeaser.com
-
freshdogsfood.com
-
myladylavish.com
-
redsofa.info
-
a5cdags-b.com
-
wrkan.com
-
globalindocctv.com
-
teacherdooley.com
-
chenzhixue.com
-
rupyamall.com
-
511hao.com
-
doncoolgadget.com
-
patientconnectmd.com
-
genupath.com
-
addarmy.com
-
ethanandmaddie2020.com
-
growthmediampn.com
-
thesocialgreen.com
-
mannersflaps.store
-
younisvisa.com
-
84483667.com
-
ironcountryllc.com
-
organbuy.com
-
superbmanshop.com
-
ultimatewellnesspro.com
-
iishon07.com
-
radkidsco.com
Targets
-
- Target Quotation.exe
- Size 955KB
- SHA256 49a4412c27e5eafc4c4365a2b2aeb962d6bf25849ab58d4e7eeb25fcfb934dcd
- MD5 9246a29da060479960879de3db2f1374
- SHA1 fecbed5c0e6cce40444994c85caf7cb838b35df7
- SHA512 d463a62e867e1b64e1a0fa22583840f6198b8af9e7cafbf6608da726fb94d66184c5abf172c150513a48ea09711633847e429b50bd3d0df09f5168799c640d7f
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext