General
- Target deme onaylama.exe
- Size 480KB
- Sample210914-kg5d4sfdb3
- SHA256 9bd0e2f3db2198a11805aedadf2ef3e75aba1c02f1bbe0fe880eb71bb6a2651b
- MD5 3ee1e4b8a914859e26ab57525c6a2447
- SHA1 91f6a137b8e17a00d552a984c417c7c347648e0f
- SHA512 def2b8ac45fc79a3a6b94bb982aebc1933969da8c14af842a01474eb10e8b8d0b13f339c5da932205572e0f403b76234ce7c332452ff3e28eb6b19106e544b06
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
deme onaylama.exe
Resource
win7-en
Malware Config
Extracted
-
formbook
-
4.1
-
vd9n
-
http://www.constructioncleanup.pro/vd9n/
-
theunwrappedcollective.com
-
seckj-ic.com
-
tyresandover.com
-
thetrophyworld.com
-
fonggrconstruction.com
-
hopiproject.com
-
sktitle.com
-
charlotteobscurer.com
-
qjuhe.com
-
girlzglitter.com
-
createmylawn.com
-
hempcbgpill.com
-
zzdfdzkj.com
-
shreehariessential.com
-
226sm.com
-
getcupscall.com
-
neuralviolin.com
-
sanskaar.life
-
xn--fhqrm54yyukopc.com
-
togetherx4fantasy5star.today
-
buyonlinesaree.com
-
percyshandman.site
-
hatchethangout.com
-
rugpat.com
-
zen-gizmo.com
-
vipmomali.com
-
lacerasavall.cat
-
aqueouso.com
-
mkolgems.com
-
sevenhundredseventysix.fund
-
fotografhannaneret.com
-
mitravy.com
-
bmtrans.net
-
linterpreting.com
-
izquay.com
-
sawaturkey.com
-
marche-maman.com
-
eemygf.com
-
animenovel.com
-
travelssimply.com
-
montecitobutterfly.com
-
volebahis.com
-
daniela.red
-
ramseyedk12.com
-
leyterealestate.info
-
patriotstrong.net
-
vkgcrew.com
-
nadhiradeebaazkiya.online
-
hotelcarre.com
-
myfabulouscollection.com
-
stellantis-luxury-rent.com
-
hn2020.xyz
-
emilyscopes.com
-
lotosouq.com
-
lovecord.date
-
stconstant.online
-
volkite-culverin.net
-
allwaysautism.com
-
sheisnatashasimone.com
-
sepantaceram.com
-
ishopgrady.com
-
lifestorycard.com
-
sexybbwavailable.website
-
domainbaycapital.com
Targets
-
- Target deme onaylama.exe
- Size 480KB
- SHA256 9bd0e2f3db2198a11805aedadf2ef3e75aba1c02f1bbe0fe880eb71bb6a2651b
- MD5 3ee1e4b8a914859e26ab57525c6a2447
- SHA1 91f6a137b8e17a00d552a984c417c7c347648e0f
- SHA512 def2b8ac45fc79a3a6b94bb982aebc1933969da8c14af842a01474eb10e8b8d0b13f339c5da932205572e0f403b76234ce7c332452ff3e28eb6b19106e544b06
- MD5 SHA1 SHA512
Formbook Payload
Suspicious use of SetThreadContext