General
-
Target
39203048BYW2993849483.exe
-
Size
656KB
-
Sample
211119-qrs2qaddf9
-
MD5
969c9f98fb5d2de8c9f4951a2dedc571
-
SHA1
5c8963a46a2f492500b9f113f9457772d5ad1d9a
-
SHA256
b7602e7d309795640e020a679f93dfd3cb890bc9073a8ead233ab5323c6e0551
-
SHA512
fd4ae7646c686e4032c80c2c36dade002cc9e2910069dde09952215e8ccbbbdea9cf40bc1bf14005675aed322627582713a2a4344ee5d209ddd239b12fcde3de
Static task
static1
Behavioral task
behavioral1
Sample
39203048BYW2993849483.exe
Resource
win7-en-20211014
Malware Config
Extracted
formbook
4.1
ob7y
http://www.metanewsroom.net/ob7y/
ipsdjf.com
mlphntec.com
restaurant-day.store
writeramylong.com
flokigamefi.com
usetianyi.xyz
punishstrikebreaker.quest
ericnfleming.com
dhhwtieen.xyz
milfhackers.com
fewefie.store
pithstsdiet.store
kirsten-hemmerich.com
casinolopoca.com
sigag.xyz
geilepoes.com
metawhatsapp.art
sarjin.xyz
toprabatte.net
lotofbrave.club
ladydunyasi.com
oeooaoio.xyz
ifarh.com
geovaluablehack.com
heatherwoodrealestate.com
788027.com
groweth2gloweth.com
corryandbee.com
chatech.community
defholdingsus.com
gymandsports213.sbs
safaknet.com
rnisk.store
yhsps.com
taxlawyeral.com
liberiathelandofreturn.net
beniclothingstore.com
onecashadvance.com
metawhatsapp.delivery
chseovx.xyz
fiftyix.com
ambassadorbed.com
doktorhelp.com
memoryck.com
ceto21.com
zomerubo.rest
tyoutrannyvidep.com
3cbzfhhx5.com
cryleo.com
thebigass.online
ofd-trade-sender.com
elchinazizov.com
shakilimam.com
soporhojecast.com
reyestacosrestaurant.com
supdeszka.com
kredit-option.com
sharonallenart.com
destockage-international.com
immediate-edge-pl.xyz
jmsjszc.com
mojuwangluo.com
tr4ders.com
zilingodigitize.com
Targets
-
-
Target
39203048BYW2993849483.exe
-
Size
656KB
-
MD5
969c9f98fb5d2de8c9f4951a2dedc571
-
SHA1
5c8963a46a2f492500b9f113f9457772d5ad1d9a
-
SHA256
b7602e7d309795640e020a679f93dfd3cb890bc9073a8ead233ab5323c6e0551
-
SHA512
fd4ae7646c686e4032c80c2c36dade002cc9e2910069dde09952215e8ccbbbdea9cf40bc1bf14005675aed322627582713a2a4344ee5d209ddd239b12fcde3de
-
Formbook Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-