General
-
Target
QUOTATION.exe
-
Size
739KB
-
Sample
210727-v6zcj1wrh6
-
MD5
f6b430cda92dd026e96e7d304d20db43
-
SHA1
701f788e29b0a9640e53c826cd871f3f9fdd3160
-
SHA256
e1f620a49978341460d102aefd71b13a0f3d36aaf8dfa042844984ad6dcfaa7c
-
SHA512
a7e82ac7e136a03e03665e4ed108ab14296726867413c464a25c5b9e28280721fec639c6a4825733c18934ad17e3840d72ab7a1ef36a4912b043e960c095c582
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win7v20210408
Malware Config
Extracted
formbook
4.1
http://www.jzmbgjj.com/j7e/
cefuoficial.com
luxmusicclub.com
getridofmyed.xyz
sports-plaza.com
peteropsomer.com
kemendi.com
divinciresolve.com
readtogrowup.com
hidex-corp.com
aladininternational.com
snesait.art
ezzpick.net
saveashow.com
eazyprintsplus.com
usadatesclub.com
rafaelraf.com
themiamadison.com
regarta.com
aiocitys.net
ahorn-invest.com
anajoiasrj.com
rozamail.com
mauriciosagastegui.com
cohorsetrails.com
alboxshop.com
jrqualityautodetailing.com
americanroofingnow.com
scszwl.com
poicol.xyz
primarybillserv.com
smallfinancials.com
rahpilates.info
workflowxray.com
clothapparels.com
cathycre8.co.uk
familiesstores.com
printbonn.com
manismas.com
krispykremesweetpeek.com
redgtc.com
uixsv.com
superiorvillage.com
fdgrenewables.com
appments.com
shanscorp.com
modelleftcoast.com
lookitlook.com
inijuslem.com
bjtqbxg.com
ontariolitigationlawyers.com
certificationroundtable.com
levelup-edu.com
muahangonl.com
lexingtonclarke.com
brapscallions.com
elti-stables.com
nivxros.com
diversifiededhospitality.com
lnstagramappealform.com
anushwirasinha.net
shopalife.xyz
mycryptotrading.net
gxsmrtwtch.icu
williamandholland.com
Targets
-
-
Target
QUOTATION.exe
-
Size
739KB
-
MD5
f6b430cda92dd026e96e7d304d20db43
-
SHA1
701f788e29b0a9640e53c826cd871f3f9fdd3160
-
SHA256
e1f620a49978341460d102aefd71b13a0f3d36aaf8dfa042844984ad6dcfaa7c
-
SHA512
a7e82ac7e136a03e03665e4ed108ab14296726867413c464a25c5b9e28280721fec639c6a4825733c18934ad17e3840d72ab7a1ef36a4912b043e960c095c582
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-