General
-
Target
Materialliste für Angebot.exe
-
Size
928KB
-
Sample
210511-mk5g1zbjpn
-
MD5
b4aba542c1d33eb248781de4ea91b3bc
-
SHA1
030778f8206c86a1e079958bf02a0747817c89f1
-
SHA256
fed5d1810dc0b8de09e6171fe452981207cf0464d9a6dcd114a1fe9e2c1759ad
-
SHA512
ba5b8d82ed08d1719cabd232e716080d6e72f8743a7c74e8d09386360c3d22db9c1849c112e2d612d2aabf40aa2d210dc47f06ecd35457ce6e6fe687d7d18f7e
Static task
static1
Behavioral task
behavioral1
Sample
Materialliste für Angebot.exe
Resource
win7v20210410
Malware Config
Extracted
formbook
4.1
http://www.tazmgloli.icu/mbg/
rouskysnanofiltrem.com
netsoftex.website
ap-hardware.com
michaelroselman.com
thegentlefamily.com
merzberg.com
mhteam.club
universallypc.com
xn--bm4bzth4kbok9nc.com
torontogreekevents.com
atlirmarisa.com
coludelegance.com
hooksandhounds.com
bobbymartz.com
empresseventsco.com
littlespinkco.com
kstilo.com
guestemails.com
thespiritoftheviking.com
haveyoueverseenawhale.com
atlantaprostatedr.com
cosmiccrime.com
chaytel.com
thismindinmotion.com
ad-amazon.com
covidsurvivorsfoundations.com
dannysgroceries.com
inc-paqette-post.com
pipastudiohn.com
erwan-faure.net
heiqfabric.com
bellaveyah.com
audiodelphia.com
ivsmerlinmachine.co.uk
sundaybeastcreative.com
cocoahappens.com
frogtownsgourmettacos.com
topperk11.com
royalpristine.com
patrycerealtor.com
mtbusa.net
e-empathy.com
chelseamindgames.com
proyectomichoacan.com
blogtaljradio.com
youronad.com
persian-gostar.com
ses-nc.com
toughpull.com
flushinghealthcoach.com
nicung.info
stmichaelsplaygroup.com
rkd.xyz
penioca.com
argent-flair.today
bistrostml.net
thesysonline.com
makeanygirlhoney.com
cwhybps.com
blogfutbol2022.com
gaixuexi.com
zoomaremote.com
openirv.com
westpalmelevators.com
Targets
-
-
Target
Materialliste für Angebot.exe
-
Size
928KB
-
MD5
b4aba542c1d33eb248781de4ea91b3bc
-
SHA1
030778f8206c86a1e079958bf02a0747817c89f1
-
SHA256
fed5d1810dc0b8de09e6171fe452981207cf0464d9a6dcd114a1fe9e2c1759ad
-
SHA512
ba5b8d82ed08d1719cabd232e716080d6e72f8743a7c74e8d09386360c3d22db9c1849c112e2d612d2aabf40aa2d210dc47f06ecd35457ce6e6fe687d7d18f7e
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-