General
-
Target
0dfb17fc59cf0a026c3185341c73ba25d6cb5ef0d886ce8dd00db39c1740c2f1
-
Size
519KB
-
Sample
211018-v4gaxaehhq
-
MD5
70a1b0e287cfb57fdafc401193a4476b
-
SHA1
b552e549510bc446c458b734ebf68c6103abc1e9
-
SHA256
0dfb17fc59cf0a026c3185341c73ba25d6cb5ef0d886ce8dd00db39c1740c2f1
-
SHA512
a485fc04e2559c654567605eac8c95b031c8f1a5bfb42be2e0ea1eb44e34faa555702db7d0258c14f12790b5cf2f54ac0a30040c58ccf0978bfee7b96789895a
Static task
static1
Malware Config
Extracted
formbook
4.1
s6tn
http://www.majordomus-gliwice.com/s6tn/
ya-volna.com
nakimura.online
buildtheyamato.com
carecard.xyz
orthozayn.com
sitd.xyz
garu.club
alfainfocom.com
floridalacrossecamps.com
banytus.xyz
dogodipiskot.quest
ljlsaf.com
shaheenricemills.com
cuevieujni.info
chrisandkcollection.com
sunadokei.website
hoidotsbirky.quest
creditassociatesllc.com
amazonhrjobs.com
the-luggage-dropp-off.com
kwwmarket.com
twdesignacreation.com
siaralntl.com
iacompetitionsasia.com
seeker-l.xyz
bytesandvotes.com
newbotong.com
dbelnlogoro.quest
isleptwell.com
effektivpeople.com
rosariopabst.com
holdvfind.store
fishhunter99.com
11km.net
cryptobloombergs.com
suppershop.store
lu2h4vasat.com
siberiancrystal.com
laxmanblog.com
ret-services.com
epm-brandsshop.com
rainbowlampro.com
mastermart.net
pintseeker.com
kioskpass.com
mpu-spezialist.com
debthlp.com
westafricaschools.com
guojiannoodlemachine.com
readingroomtnpasumo5.xyz
liferooz.com
farmavidacanarias.com
voconunve.xyz
sekshikayelerimiz.info
paybro.online
condensus.com
zaratwo2.com
zcfxwl.com
sephorapets.com
arabatalmustahlik.com
poojas.xyz
verbenalifestyle.com
gabinettomedico.com
khazis.com
Targets
-
-
Target
0dfb17fc59cf0a026c3185341c73ba25d6cb5ef0d886ce8dd00db39c1740c2f1
-
Size
519KB
-
MD5
70a1b0e287cfb57fdafc401193a4476b
-
SHA1
b552e549510bc446c458b734ebf68c6103abc1e9
-
SHA256
0dfb17fc59cf0a026c3185341c73ba25d6cb5ef0d886ce8dd00db39c1740c2f1
-
SHA512
a485fc04e2559c654567605eac8c95b031c8f1a5bfb42be2e0ea1eb44e34faa555702db7d0258c14f12790b5cf2f54ac0a30040c58ccf0978bfee7b96789895a
-
Formbook Payload
-
Drops startup file
-
Suspicious use of SetThreadContext
-