General
- Target pfr 80954820021.exe
- Size 702KB
- Sample210908-wxmpsaehd9
- SHA256 83b3d86539fd63f97b860e86c3e61b4e2c64dc1ff2936566d5bda292ab6e478d
- MD5 a59ac7b2bcf00d4d15a9a010d56139b0
- SHA1 09e4feef7b72c18b90b589f0d3f7f4fccba1664c
- SHA512 a97e111d09fc0319552101ce3aa3e20e7e20e8ca6bfd2e0a51191bb15de98b0cd323f845382dea87a370433e9608e01c70c5edb20a657963c708134cc6136248
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
pfr 80954820021.exe
Resource
win7-en
Malware Config
Extracted
-
formbook
-
4.1
-
ergs
-
http://www.barry-associates.com/ergs/
-
jardineriavilanova.com
-
highkeyfashionboutique.com
-
willingtobuyyourhouse.com
-
ysfno.com
-
bjkhjzzs.com
-
hexmotif.com
-
intentionalerror.com
-
nuu-foundfreedom.com
-
catalystspeechservices.com
-
blackmybail.com
-
xntaobaozhibo.com
-
site-sozdat.online
-
45quisisanadr.com
-
ipawlove.com
-
yifa5188.com
-
admm.email
-
houseoftealbh.com
-
scale-biz.com
-
vdvppt.club
-
loveandlight.life
-
529jpmorgan.com
-
pupupe.com
-
asantejaratmavi.com
-
stereovisionstudio.com
-
anhhoangnhatle.com
-
robrowerealestate.com
-
accessorthopaedics.com
-
vanaform.com
-
hataribeauty.com
-
karnez.net
-
meghanariana.com
-
lawboutique30.com
-
sailoame.com
-
waystoearnmoneyontheside.com
-
alkalides.com
-
finqian.com
-
ic-video-editing.co.uk
-
vomartdesign.xyz
-
xn--icknb7d2bb8tv280bco4a.com
-
containerreefer.com
-
maison-connect.com
-
fbtowww.com
-
phoenizoo.com
-
bet365l6.com
-
royalglossesbss.com
-
justiceforashleymoore.com
-
hupubets.com
-
technomarkets.info
-
ahhaads.com
-
vvbeautystudio.com
-
ddogo2o4r.online
-
ameliefantaisie.com
-
signupforhuntington.com
-
antibodycovid19testkit.com
-
kuznecova.center
-
yuxingo.com
-
heseasy.site
-
wilmingtondollshow.com
-
196197.com
-
domineaconfeitaria.com
-
veryzocn.com
-
regenerativesouls.com
-
llamshop.com
-
miami-autoparts.com
Targets
-
- Target pfr 80954820021.exe
- Size 702KB
- SHA256 83b3d86539fd63f97b860e86c3e61b4e2c64dc1ff2936566d5bda292ab6e478d
- MD5 a59ac7b2bcf00d4d15a9a010d56139b0
- SHA1 09e4feef7b72c18b90b589f0d3f7f4fccba1664c
- SHA512 a97e111d09fc0319552101ce3aa3e20e7e20e8ca6bfd2e0a51191bb15de98b0cd323f845382dea87a370433e9608e01c70c5edb20a657963c708134cc6136248
- MD5 SHA1 SHA512
Formbook Payload
Deletes itself
Suspicious use of SetThreadContext