General
- Target NEW_ORDERS 122020 2 x 40 HQ.exe
- Size 805KB
- Sample210508-j1rxhm38vj
- SHA256 8a116bfcbc1c440c1491513ee9efde46fe7f2e7f24fcdb3f43ee21d0917face7
- MD5 7ceac88b29ab061f0fc1f9915006060f
- SHA1 b7cceb6c9e8c50cda1b6f8643f2d123ca100d8b2
- SHA512 dd6a0a57db0d85064962c8f8809d512a88294d4e773f9cb3acf033794edd647e1c4b9e24f4b774b858dcfdfc26def801c57d8f185300ae8784e8e5a0c8e44394
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
NEW_ORDERS 122020 2 x 40 HQ.exe
Resource
win7v20210408
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.supinapp.com/grv/
-
morganofatlanta.com
-
vz473.com
-
hengetelt.com
-
bailcally.com
-
virtuosoonline.com
-
tenthousandli.com
-
ohanamascota.com
-
digi-plates.com
-
prismagtech.com
-
we-cinema.com
-
372680.com
-
smartautoexpert.xyz
-
mrxzg.com
-
apartment-brussels.com
-
reverseincubator.com
-
linkasean.com
-
yummicrabva.com
-
diguchaye.com
-
reaktorfatura.com
-
thecatsaysno.com
-
mpgcommunications.net
-
lindustrieetleca.com
-
seosansar.com
-
alohalily.com
-
novergi.com
-
universityincanada.info
-
atrocity.xyz
-
johnsonballoonblessings.com
-
laurelmcintosh.com
-
nubedepalabras.com
-
ycmath.com
-
daveysdestinations.com
-
yourgutterguru.com
-
mayas.website
-
bessgarments.com
-
xhegu.com
-
mybusinessdoor.com
-
vivaceactivewear.com
-
nongyan.net
-
tgi-mail.net
-
j999a.com
-
slteka.com
-
pikipikiit.com
-
as0594.com
-
insuremydriverslicense.com
-
kclundsblades.com
-
haircleanerpro.com
-
charlesnwahiwe.com
-
ervoth.com
-
authentiekinnovations.com
-
molvmg.icu
-
xn--k1abtc6be.xn--p1acf
-
arm-srl.com
-
hood2healer.com
-
austinchapter7.com
-
clarityentct.com
-
bryllaw.com
-
twinworksllc.com
-
top-trend.website
-
rueschlink.com
-
oogilab.com
-
thewritersbookshelf.com
-
jademarkproducts.com
-
400city.com
Targets
-
- Target NEW_ORDERS 122020 2 x 40 HQ.exe
- Size 805KB
- SHA256 8a116bfcbc1c440c1491513ee9efde46fe7f2e7f24fcdb3f43ee21d0917face7
- MD5 7ceac88b29ab061f0fc1f9915006060f
- SHA1 b7cceb6c9e8c50cda1b6f8643f2d123ca100d8b2
- SHA512 dd6a0a57db0d85064962c8f8809d512a88294d4e773f9cb3acf033794edd647e1c4b9e24f4b774b858dcfdfc26def801c57d8f185300ae8784e8e5a0c8e44394
- MD5 SHA1 SHA512
Formbook Payload
Deletes itself
Suspicious use of SetThreadContext