General
-
Target
2bINu9BOqKtJHoo.exe
-
Size
1.1MB
-
Sample
210721-azxrjttpvs
-
MD5
b8b1a1e689be765aad3fe0f8d97199af
-
SHA1
96b923aaa5b0d3e9974b4080298bb8a7bcfcf725
-
SHA256
f0e734543c047d2ca1a76a4e47553e85d50c57ff9d3dfbd0e55806ff890fef38
-
SHA512
1f64bbf0bed9cc5cd04da93a9da7346774a493f73171b87f1331da5d00dc970d054ccc73935e57341512bd7d8827c3c88319f4458c30f0d09a6b25c91f356f7c
Static task
static1
Behavioral task
behavioral1
Sample
2bINu9BOqKtJHoo.exe
Resource
win7v20210410
Malware Config
Extracted
formbook
4.1
http://www.bulverderoofing.com/lt0h/
originalindigofurniture.co.uk
fl6588.com
acecademy.com
yaerofinerindalnalising.com
mendilovic.online
rishenght.com
famlees.com
myhomeofficemarket.com
bouquetarabia.com
chrisbani.com
freebandslegally.com
hernandezinsurancegroup.net
slicedandfresh.com
apnathikanas.com
chadhatesyou.com
ansilsas.com
in3development.com
nitiren.net
peespn.com
valengz.com
theseakelpcompany.com
tlcrentny.com
sancakcraft.com
kamenb.com
samanthajobenson.com
alphagearz.com
sprins.net
adestramentos.com
civoconstruction.com
masrmasr.com
jagrit.codes
zusammenurlaub.com
mssjqs.com
ic695niu001.com
anelimplus.com
mutlob.com
beyondmickey.net
sliever.club
perfumefashion.icu
massimilianogiannocco.com
dentoncountyattorneys.media
filigreefilly.com
mooremgmtandcompany.com
smpdj.com
stainlesspropmgmt.com
creativecollectivecommunity.com
dmdrogist.com
spokenandheardpodcast.com
garenbid.com
bestcomandcalls.space
tairunshihua.com
nemski-projekt.com
6mum.com
portlandhemorrhoidcenter.com
platinumforsale.net
driven.plus
ontheedgeoutdoorshunting.com
manatapmasalalu.com
idscustomprinting.com
safepassagereform.com
fairop.xyz
natetacticz.com
etoys-sucks.com
rhinolabs.net
Targets
-
-
Target
2bINu9BOqKtJHoo.exe
-
Size
1.1MB
-
MD5
b8b1a1e689be765aad3fe0f8d97199af
-
SHA1
96b923aaa5b0d3e9974b4080298bb8a7bcfcf725
-
SHA256
f0e734543c047d2ca1a76a4e47553e85d50c57ff9d3dfbd0e55806ff890fef38
-
SHA512
1f64bbf0bed9cc5cd04da93a9da7346774a493f73171b87f1331da5d00dc970d054ccc73935e57341512bd7d8827c3c88319f4458c30f0d09a6b25c91f356f7c
-
Formbook Payload
-
Suspicious use of SetThreadContext
-