General
-
Target
REQUEST FOR QUOTATION (2).exe
-
Size
485KB
-
Sample
211018-p2dt4sdeh6
-
MD5
a8e3b5b211ec454517c8d8fc7b0739e4
-
SHA1
b4193534f86bfd3e1a46530b3b129249eb463495
-
SHA256
d17dc5760a94c6a8d85b462dfe3cfdf40917e670513dadd5fd5eeaa9941106af
-
SHA512
d12b5fc8557b98b266d50e6e44f76d1ae6f95d9e0a736bdaac4ecce4d243647def61686ae523e4db9e511ebba55b472e435e6785a5b36eb67583aa73eef0c266
Static task
static1
Behavioral task
behavioral1
Sample
REQUEST FOR QUOTATION (2).exe
Resource
win7-en-20210920
Malware Config
Extracted
formbook
4.1
cb2k
http://www.freegovphoneservice.com/cb2k/
prets-personnels-faciles-1.com
lavandica.com
855goldenpark.com
ebrandschool.com
annielaineinspirations.com
tuscumbiadivorceattorney.com
lovarebanwgt74.xyz
car-plus.info
fireloops.net
psychtechsolutions.com
didubreak.com
cursodesigndesobrancelhas.com
berrymyrick.com
visit-croatia-now.com
chamonix-cars.club
1679tnpnd01uzznpvfu8795.com
noisedelayrecovery.com
sergiotimoteo.com
lplc.cloud
ppezjo.com
pernam.xyz
789463.com
triadinjurylawyer.com
bergenbibliotek.com
justgarageflooring.com
cloudmirror.xyz
pokilj.xyz
lnpost.net
deadlyartzjv.xyz
videotodayonline.com
stefanotocco.com
darlinmarket.com
bh-cbd.com
ovghjm.com
jsaben.com
retail-shop-art.com
safehamstersleague-giveaway.com
mejorespatineteselectricos.com
allworklancer.com
memoriesartforever.com
maheshlivera.com
newyorktoken.com
visions.expert
eroticvideos.xyz
luma-seminaire.com
ejoieshop.com
artemissharpe.com
yh7442.com
miiromance.com
heetstanbul.com
bumemleketbizim.com
w7world.design
epixeirisi.xyz
thevahid.com
popolatec.rest
blackband.site
unfreeze-seattle.com
smartpottery.com
harmonyisus.com
coworkerspot.com
cronanna.com
eest3si.com
israelnewstoday.com
insurance-quote-4-il.com
Targets
-
-
Target
REQUEST FOR QUOTATION (2).exe
-
Size
485KB
-
MD5
a8e3b5b211ec454517c8d8fc7b0739e4
-
SHA1
b4193534f86bfd3e1a46530b3b129249eb463495
-
SHA256
d17dc5760a94c6a8d85b462dfe3cfdf40917e670513dadd5fd5eeaa9941106af
-
SHA512
d12b5fc8557b98b266d50e6e44f76d1ae6f95d9e0a736bdaac4ecce4d243647def61686ae523e4db9e511ebba55b472e435e6785a5b36eb67583aa73eef0c266
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-