General
- Target DHL_AWB_NO#907853880911.exe
- Size 911KB
- Sample210712-2pzaaeg89a
- SHA256 1640d521a0e5aff2aeb9eb892c8b19d0897e22c73940c394a5cb12af271de6ec
- MD5 12bb1ef9dc1f0c1ba8d51fda59300e36
- SHA1 e9ea95e8418a3e2e09e331777139ede61682bbd4
- SHA512 9e822b28ad6b3b54660be6bbbd16f0338582bbf5e947534a6cc38e16f48917818cb2bc20105a0fb10af766074ad8262de63e47fa4fba2938b9f0b3fb2be2fe75
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
DHL_AWB_NO#907853880911.exe
Resource
win7v20210410
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.bitcoin-noticias.com/fw6/
-
rashtriyasanghsewak.com
-
filestree.cloud
-
penoner.com
-
owliwant.com
-
elkincook.com
-
jhac16kaizencollection.com
-
shalomdentalavenue.com
-
hotelsbytheweek.com
-
cookwithchefcari.com
-
threattenterprises.com
-
sanookna.com
-
tlsbuilders.com
-
softandhardshop.com
-
ppr419.com
-
powertexinc.info
-
businessandhr.com
-
yiliao2020.com
-
eiman-pro.com
-
rhondarothrealtor.com
-
junk-service.com
-
55668.online
-
clarionintroducers.com
-
dotchugui.com
-
iymood.com
-
iphonesglasses.com
-
scores193843.xyz
-
bux4all.com
-
marlboromeadows.com
-
intercosmicshop.com
-
innne.com
-
gkjpondokgede.com
-
thedomushub.com
-
djdygytal.com
-
sportgamessa.com
-
pauspay.com
-
fordbieter.com
-
mortgageswithmelodie.com
-
umdesenhoqueanime.com
-
itech-servicios-sv.com
-
fairviewsecurity.com
-
maqalat93.com
-
unstuckwebinar.com
-
zen-code.guru
-
byssm.com
-
dylanfashion.com
-
atlastanimalrescue.com
-
yunzhangjiang.com
-
calia.group
-
biorythmbalance.com
-
specna.com
-
outdoorpropertylist.com
-
hg8808dh.com
-
justvapesa.com
-
homeinspectorreviews.com
-
mitplindia.com
-
solevux.com
-
mentalgto.com
-
tenin123.com
-
beautyholicsbybernards.com
-
shadhinbazaar.com
-
cxi.xyz
-
totumdrinks.com
-
defikrypto.com
-
thegreatbournecommunity.com
Targets
-
- Target DHL_AWB_NO#907853880911.exe
- Size 911KB
- SHA256 1640d521a0e5aff2aeb9eb892c8b19d0897e22c73940c394a5cb12af271de6ec
- MD5 12bb1ef9dc1f0c1ba8d51fda59300e36
- SHA1 e9ea95e8418a3e2e09e331777139ede61682bbd4
- SHA512 9e822b28ad6b3b54660be6bbbd16f0338582bbf5e947534a6cc38e16f48917818cb2bc20105a0fb10af766074ad8262de63e47fa4fba2938b9f0b3fb2be2fe75
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext