General
- Target 50568fb6133ee4ed721ee46a3c0a9e98.exe
- Size 669KB
- Sample210927-psgjmsghgr
- SHA256 2b1a98add215568bb5e1c333321cf0ffe98d9128fa149c4f5a07ce2922750b3e
- MD5 50568fb6133ee4ed721ee46a3c0a9e98
- SHA1 4897b6f2141395071652f72d34dc3d39eb014a56
- SHA512 d5facfcf30e3e9f815f595c3af6992551d623a5592c13e7ae8df4e29e7f6401523339bf5a7835d46c80b998fdc3338530ea677f85a08c4fe16829a83879f529f
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
50568fb6133ee4ed721ee46a3c0a9e98.exe
Resource
win7-en-20210920
Malware Config
Extracted
-
formbook
-
4.1
-
cmsr
-
http://www.odysseysailingsantorini.com/cmsr/
-
dahlia-dolls.com
-
iamawife.com
-
gardunomx.com
-
roweelitetrucking.com
-
asapvk.com
-
strategieslimited.com
-
healthyweathorganics.com
-
wedding-gallery.net
-
fastoffer.online
-
biolab33.cloud
-
los40delocta.com
-
charliepaton.com
-
jenpaddock.com
-
zzmweb.com
-
poetarts.com
-
techwork4u.com
-
tracylynpropp.com
-
rkbodyfit.site
-
migaleriapanama.com
-
cosmostco.com
-
johnsoncamping.com
-
flowfinancialplanning.com
-
xn--caamosdemexico-rnb.com
-
plusqueindia.com
-
wwwhyprr.com
-
benimofis.com
-
tandteutopia.com
-
spaintravelvacation.com
-
dear.services
-
zhiwugongfang.com
-
blogdavnc.com
-
justicefundingexchange.com
-
alphasecreweb.info
-
xitechgroup.com
-
kendalmountain.digital
-
nieght.com
-
pieter-janenmaaike.online
-
myexclusiveshop.com
-
love-potato.online
-
mondebestglobal.com
-
ranchlandconcierge.com
-
southerngraphx.com
-
pray4usa.info
-
vilchesfinancial.com
-
zelvio.store
-
zenibusiness.com
-
kindredhue.com
-
californiatacosdinuba.com
-
uncommonsolutionsllc.com
-
easy-lah.com
-
disciplesevents.com
-
856380127.xyz
-
zapzapgone.com
-
paradisgrp.com
-
programmerworks.info
-
purchasesuite.com
-
dorotajedrusik.com
-
555999dy.com
-
uvoyus.com
-
utang.net
-
elizabethhelma.com
-
noseainsight.com
-
simpleterior.com
-
casatensina.com
Targets
-
- Target 50568fb6133ee4ed721ee46a3c0a9e98.exe
- Size 669KB
- SHA256 2b1a98add215568bb5e1c333321cf0ffe98d9128fa149c4f5a07ce2922750b3e
- MD5 50568fb6133ee4ed721ee46a3c0a9e98
- SHA1 4897b6f2141395071652f72d34dc3d39eb014a56
- SHA512 d5facfcf30e3e9f815f595c3af6992551d623a5592c13e7ae8df4e29e7f6401523339bf5a7835d46c80b998fdc3338530ea677f85a08c4fe16829a83879f529f
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext