General
- Target AWB 224000318400 - 224000318040.exe
- Size 229KB
- Sample210601-4dn9fv112x
- SHA256 d3b19cf0506617e6ac964656ebfe51f1c3066337b66bfdb48bd31b44ff61e7fb
- MD5 266bab51a4de290dcc0989b60283e502
- SHA1 99db20966cf4c4d4434b6a53058be600d08b5340
- SHA512 e7dc69ddc1b2d2c547cd3bca92550336da41f01bcb20cba7d5bb097385deef55ef43dbf21752be5a8115e46ef82a2ca6106ad6395c469d4bb54f39f2facc4636
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
AWB 224000318400 - 224000318040.exe
Resource
win7v20210408
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.updatesz.com/hlx/
-
firo.store
-
unmeasured-grace.com
-
burger-ff.com
-
alcargomoversllc.com
-
brianratkevich.com
-
semugaralara01.net
-
ngalvision.com
-
texaslearningpods.com
-
ontarioboatcharters.com
-
kleinrugcleaning.com
-
michaelvancebromfield.com
-
habitameya.com
-
elyoma.com
-
worldtvepisode.com
-
masatakahorie.com
-
jumpinginfo.com
-
hfjxhs.com
-
bf-swiss.com
-
rvingbus.com
-
suxfi.com
-
schoolcardtrades.com
-
motion-airsoft.com
-
123netflix.moe
-
ic200mdl750.com
-
silkensarees.com
-
digitalmarketingtraining.xyz
-
foypay.com
-
eudoraacantik.com
-
healthyandwealthie.com
-
print-postcards-fast.com
-
alpha-psych.com
-
merthyrrock.com
-
mss52.com
-
cddcsw.com
-
istanbulbisiklettamircisi.com
-
ertugrulbey.net
-
katarina-yoga.com
-
findholmesinlaurelmaryland.com
-
sabciu.net
-
shipthuocnhanh24h.com
-
veganonthegreens.com
-
ailil-alvarez.com
-
thefashionszone.com
-
geminicomputerofficial.com
-
terraveda.net
-
ruhstorfer-gruppe.info
-
suderstr.com
-
yunjichem.com
-
priyadubai.com
-
sofierceboutique.com
-
nealcurtiss.com
-
mcgdinner.com
-
steplife.info
-
pwagih.com
-
cpzgzcw.com
-
wierzewzwierze.com
-
asbestosconsultancyservices.com
-
centerstageacademyaz.com
-
skip1-dndasasd.com
-
successteamrealty.com
-
mijninboxe.com
-
berkeleyrehab.com
-
tfjxw.com
-
mcluxuryrentals.com
Targets
-
- Target AWB 224000318400 - 224000318040.exe
- Size 229KB
- SHA256 d3b19cf0506617e6ac964656ebfe51f1c3066337b66bfdb48bd31b44ff61e7fb
- MD5 266bab51a4de290dcc0989b60283e502
- SHA1 99db20966cf4c4d4434b6a53058be600d08b5340
- SHA512 e7dc69ddc1b2d2c547cd3bca92550336da41f01bcb20cba7d5bb097385deef55ef43dbf21752be5a8115e46ef82a2ca6106ad6395c469d4bb54f39f2facc4636
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext