General
-
Target
#6495PI-29458-2020.exe
-
Size
919KB
-
Sample
210722-8p11mtl6c2
-
MD5
020c3201638570f2858099e3e522a9a0
-
SHA1
c3977925522b50fc59c2d2e1e014e24052d36fce
-
SHA256
24e635e80cecd03066225b27fdb524c4542586b22dc820e05f8a02072008c674
-
SHA512
11455186a0f8d4ad74de60cb4fa2acf399c8c39887ef979fa5b3d2568b530bc5d8c91c70dd3a7621df9e37ba3b1360fe38201146ed39dc185b03656a2ff8e173
Static task
static1
Behavioral task
behavioral1
Sample
#6495PI-29458-2020.exe
Resource
win7v20210408
Malware Config
Extracted
formbook
4.1
http://www.nouolive.com/wt5i/
mydreamct.com
vadicore.com
choicemango.com
projectsolutionspro.com
ncg.xyz
goio.digital
ee-secure-account.com
criminalstudy.com
fsjuanzhi.com
pont-travaux-public.com
agencepartenaire.com
jlsyzm.com
prosselius.com
woodendgroups.com
thereproducts.site
sigmagrupo.net
chelseagracia.com
fusosstore.com
chrissypips.trade
mvlxplcswa.com
sneguard.com
travellingcomet.com
ledbydesign.asia
yaysondaj.com
recoverydharma.guide
peak8000.com
alltranslation.xyz
igorkozel.com
x-box2send.club
campgoodco.com
arrowinvestments-technology.com
naturally-preserved.com
vk-authorization.site
xn--12cfjb7d8dd4ftb6cr0g5e.net
losjazminesdelamolina.com
farmaciamoyatoledo134fmas.com
sgainme.com
corcoran.network
nestarchitectural.com
nnltsy.com
wyoming-interactive.net
laomao.site
qiwuwenhua.com
conectals.com
wanggou0579.com
nanmedia.info
kindredheatrsteam.com
passiveincomeincubator.com
eletroclimaks.com
getbackmode.com
clearvuetaxadvisors.com
pick-assiette.com
tribelinx.com
1bodymobile.com
united-for-humanity.net
hoatao.xyz
isbpestcontrol.com
nieght.com
pinoyhoustontv.com
bloochy.com
greatestpotever.com
onikidil.com
inspirainstitute.com
yourcariq.com
Targets
-
-
Target
#6495PI-29458-2020.exe
-
Size
919KB
-
MD5
020c3201638570f2858099e3e522a9a0
-
SHA1
c3977925522b50fc59c2d2e1e014e24052d36fce
-
SHA256
24e635e80cecd03066225b27fdb524c4542586b22dc820e05f8a02072008c674
-
SHA512
11455186a0f8d4ad74de60cb4fa2acf399c8c39887ef979fa5b3d2568b530bc5d8c91c70dd3a7621df9e37ba3b1360fe38201146ed39dc185b03656a2ff8e173
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-