General
- Target 6b76b31674beb7e8aa442834dacd9b8f
- Size 555KB
- Sample211109-p7hegscdan
- SHA256 02a852aaa839120b0e557629b63a754cb302ebe2f11275d3e4fb68f4f1e70532
- MD5 6b76b31674beb7e8aa442834dacd9b8f
- SHA1 d8f26c60fc804d46482850f3daf6466372798237
- SHA512 53a64fafcf71ddc1263535cf1865a296f6331607985634bf8147a8cb527e41ec6fd822708a41eac553ca72febe2a22300605a62f89ffa4b8c278a9ed69608e42
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
6b76b31674beb7e8aa442834dacd9b8f.exe
Resource
win7-en-20211104
Malware Config
Extracted
-
formbook
-
4.1
-
nqm8
-
http://www.mmsite.site/nqm8/
-
gr8leiloes.com
-
workali.com
-
tom641220480.online
-
metaversehome.tech
-
aljinternationalcorp.com
-
drofekt.com
-
landmanagementdirtworksnwar.com
-
liaslaton.com
-
hanswelliot.com
-
sterling2.xyz
-
metatock.com
-
tnbankauctionproperties.com
-
366466.com
-
g1ft-portal.net
-
highlandsdg.com
-
letsgorebranding.com
-
tc76.xyz
-
colo2022.xyz
-
reikicertificationcourses.info
-
metawks.com
-
bomgogo.online
-
luxhandmadecaferestaurant.com
-
siverekavm.com
-
rookmelders-limburg.online
-
qiyongsh.com
-
vetfinder.online
-
l-evatedautosales.com
-
shshbkj.com
-
ionbeammetaverse.com
-
metasttropez.com
-
riverpearlplus.com
-
propertiespy.com
-
scatlon.xyz
-
gargconsultancyservices.com
-
tidheuti.xyz
-
bluestudiosmint.com
-
gremfree.com
-
metarance.digital
-
snarlsymbol.store
-
desireeojeda.com
-
suzheng.xyz
-
dopescars.com
-
xiuxiude.com
-
wwwdisneyresortmetaverse.com
-
randdjobs.com
-
mehtaversal.com
-
mondock.legal
-
athayoganow.com
-
hcaptoth.xyz
-
kaitosmotoryacht.com
-
metawarehause.xyz
-
ufakj15.com
-
loveonlinewakun16.xyz
-
rtkfa031.xyz
-
ychcrabs.com
-
projectaveria.com
-
xn--pilzkrbchen-vfb.com
-
golosmega.online
-
myangeltreasures.com
-
khrist.store
-
smiledirectclubchina.com
-
vixplustv.com
-
new5g-msg.com
-
arizonaadventurevans.com
Targets
-
- Target 6b76b31674beb7e8aa442834dacd9b8f
- Size 555KB
- SHA256 02a852aaa839120b0e557629b63a754cb302ebe2f11275d3e4fb68f4f1e70532
- MD5 6b76b31674beb7e8aa442834dacd9b8f
- SHA1 d8f26c60fc804d46482850f3daf6466372798237
- SHA512 53a64fafcf71ddc1263535cf1865a296f6331607985634bf8147a8cb527e41ec6fd822708a41eac553ca72febe2a22300605a62f89ffa4b8c278a9ed69608e42
- MD5 SHA1 SHA512
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Suspicious use of SetThreadContext