General
- Target file.exe
- Size 185KB
- Sample210928-qcmldscae4
- SHA256 dcee55c9896715272cfd344a7a62fe6c5dbe0e61d7d8548beeda46c15bd8e07c
- MD5 ec7465664bc2345ef248e248a1b5899d
- SHA1 79722fc086458b2fef063047ed56360096dbccc9
- SHA512 f34c40c74e8f4e1e798afde72349c163294f29a23687cb5f8a9b74008f7a3ee523c3fd4d0340ae69e08da5999fe81cf5251d8bd61d084a016e64d12b84a7f052
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-en-20210920
Malware Config
Extracted
-
formbook
-
4.1
-
j3gd
-
http://www.fracturedmindset.com/j3gd/
-
lpumanagement.com
-
seafreshindia.com
-
progetto-energia.com
-
anthonyconstantis.com
-
wuhanyinyue.com
-
rimflso.com
-
zayedcenter.net
-
toggturkish.com
-
grayshottspalife.com
-
migliorarelasalute.website
-
micj1426.com
-
salicosmetic.com
-
renospro.com
-
fantasiegeschichten.com
-
velvetgoo.art
-
chasernt.online
-
mojogrup.com
-
beer-app.com
-
workitsexyguru.com
-
rmhansonfreelancewriting.com
-
03c3tnpvnu16sxlpreu2281.com
-
thesolitairebliss.com
-
meshworksmanagement.com
-
womento.kitchen
-
trippytigerzteaparty.com
-
ellemediallc.com
-
organonacademy.com
-
aprabha.com
-
natifar7884.com
-
groupeosiris-afrique.com
-
tedswoodworking16000.com
-
cardgalaxyapp.com
-
bajutidur.xyz
-
gettheforkouttampa.com
-
luxivana.com
-
americanvrfarm.com
-
qypcurso.xyz
-
anguillalitfest.com
-
dirigirbem.com
-
evolvehemb.com
-
photographyofcharlotte.com
-
springhousemanagement.com
-
domainedemontessori.com
-
adoniobet.com
-
travelermeet.com
-
mtools-usa.com
-
lulushomecakery.com
-
aaronparecki.xyz
-
moderevolt.com
-
bookhousehotel.com
-
carcof.com
-
kolomalabs.com
-
4on6.com
-
boostblackgirllove.com
-
differentesports.com
-
motherearthhaulers.com
-
pacificpaymentprocessing.com
-
sinooceancastle.com
-
smothe.today
-
aisoulspa.com
-
rentventory.com
-
oota-group.com
-
aryuzhou.net
-
as1-6hg9amazon.com
Targets
-
- Target file.exe
- Size 185KB
- SHA256 dcee55c9896715272cfd344a7a62fe6c5dbe0e61d7d8548beeda46c15bd8e07c
- MD5 ec7465664bc2345ef248e248a1b5899d
- SHA1 79722fc086458b2fef063047ed56360096dbccc9
- SHA512 f34c40c74e8f4e1e798afde72349c163294f29a23687cb5f8a9b74008f7a3ee523c3fd4d0340ae69e08da5999fe81cf5251d8bd61d084a016e64d12b84a7f052
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext