General
-
Target
f1d94fcc611053cd5162e70dc36fddfa
-
Size
684KB
-
Sample
211015-j56fmsbder
-
MD5
f1d94fcc611053cd5162e70dc36fddfa
-
SHA1
52ecf628c9fe25f2eedca8da56aa0785958e2638
-
SHA256
4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348
-
SHA512
f422f6332bb00eabec395ce4154c940632feafba67a2206cbfa5700114dee0bc38b394febe09aecdf4cae6f9bdfd232491c1f8a179813c52c763ce3b7bbd87f7
Static task
static1
Behavioral task
behavioral1
Sample
f1d94fcc611053cd5162e70dc36fddfa.exe
Resource
win7-en-20210920
Malware Config
Extracted
formbook
4.1
hs3h
http://www.alefisrael.com/hs3h/
slairt.com
teresasellsflorida.com
resouthcarolina.com
npccfbf.com
hutshed.com
westatesmarking.com
rustmonkeys.com
kagawa-rentacar.com
easyvoip-system.com
admorinsulation.com
ericaleighjensen.com
zhonghaojiaju.net
apple-iphone.xyz
b0t.info
torgetmc.xyz
lawrencemargarse.com
6123655.com
macdonalds-delivery.com
cvpfl.com
ayudaparaturent.com
toptenanimals.com
zambiadawn.com
muzoe.com
xtrembabes.com
nomadicfoodpods.com
sibernewskaltara.com
thelyfetour.com
sailinn.xyz
cisiworld.com
right-effort.com
emmanuelleramaroson.com
aptgdaycare.com
yanceyhomes.com
minooshargh.com
littlemontars.com
liuhemustam.com
tajaraenterprises.com
myteepathfinder.com
nectarselector.com
digitalbusinesscard.website
kirakira-woman.xyz
tntexpressdelivery.com
collectcuriously.com
marielagarciarealty.com
javierramonmartinezalarcon.com
eis-investment.com
bookanyclick.com
primespotshop.com
heatdistrict.xyz
beadedjoy.com
oyster-gal.com
umateam.com
reservadaspalmeiras-mg.com
thiramirez.info
stanfec.xyz
cowcoupon.com
humaneeventmedia.com
exquisitepdc.com
silverartandcraft.com
plomeroelectricistaquintana.com
encounterniagara.com
ram-nilu.com
standwithcode.com
sphereexit.com
Targets
-
-
Target
f1d94fcc611053cd5162e70dc36fddfa
-
Size
684KB
-
MD5
f1d94fcc611053cd5162e70dc36fddfa
-
SHA1
52ecf628c9fe25f2eedca8da56aa0785958e2638
-
SHA256
4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348
-
SHA512
f422f6332bb00eabec395ce4154c940632feafba67a2206cbfa5700114dee0bc38b394febe09aecdf4cae6f9bdfd232491c1f8a179813c52c763ce3b7bbd87f7
-
Formbook Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-