General
- Target AWB_NO_9284730932.exe
- Size 521KB
- Sample211124-ree5rsgad6
- SHA256 df70c8209f25283b9f315676eb12c7ea09c683501386f1290e347f70fb4079ff
- MD5 3d37488e03dbbc57942e789c12857309
- SHA1 4ab062ae7e02c5f0538f667c11d6bcc7117acf62
- SHA512 eb5869ad70b9e1d80b12351a8c51156ca37a37edb31c5bd78f8818b76f71b560788ff8e2f08b8d36b8769dd9e2d34189219264a69d7dc8c3da904bfaeb86e4a0
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
AWB_NO_9284730932.exe
Resource
win7-en-20211104
Malware Config
Extracted
-
formbook
-
4.1
-
fl9w
-
http://www.makheads.com/fl9w/
-
alicebowtique.com
-
way2discounts.com
-
chihangjingmi.com
-
exmcap.com
-
artisquid.com
-
financelbs.com
-
tresholdnetwork.com
-
www-9367.com
-
funtripsouthindia.com
-
ibew-neca.com
-
elqaunim.com
-
gbetapi.com
-
turkthee.com
-
greaterdetroitrealtyexpert.com
-
springhousevet.com
-
dgjt1688.com
-
broomsweeping.com
-
bettyfred.xyz
-
afmcabnot6.xyz
-
toylandmetaverse.com
-
livelifeloveloes.com
-
tabuchikazuharu.com
-
johnnymarrjaguarguitar.com
-
pintoppers.net
-
anstransport.net
-
gazprommeta.com
-
starisle.online
-
abbeastore.com
-
piratcigo.com
-
opito.digital
-
bemaster.guru
-
foerderportal-thueringen.net
-
mendy.link
-
qasimabdullah.com
-
michaelsmetaverse.com
-
oasiganaiblog.com
-
metaplayvr.com
-
lesspainmoresleep.com
-
600717ua.xyz
-
lauraderksen.com
-
listentoyourovo.com
-
businessfunnelpro.com
-
lowpricetoday.online
-
etutorpay.com
-
uootpon.xyz
-
dazelu8.com
-
kirklandweightlosssecret.com
-
godrunner001.com
-
melvinmillsroof.com
-
herdeiras.com
-
fitztoursmontreal.com
-
super-ultra-porn.net
-
choumok-bom.com
-
raribledollar.com
-
womencando.info
-
meicarijp-jpo.com
-
yymfzp.com
-
sops.wiki
-
rusungolf.com
-
smellyrose.com
-
hueslook.club
-
screenlyco.com
-
akasamotor.online
-
formacioneducaciondesarollo.com
Targets
-
- Target AWB_NO_9284730932.exe
- Size 521KB
- SHA256 df70c8209f25283b9f315676eb12c7ea09c683501386f1290e347f70fb4079ff
- MD5 3d37488e03dbbc57942e789c12857309
- SHA1 4ab062ae7e02c5f0538f667c11d6bcc7117acf62
- SHA512 eb5869ad70b9e1d80b12351a8c51156ca37a37edb31c5bd78f8818b76f71b560788ff8e2f08b8d36b8769dd9e2d34189219264a69d7dc8c3da904bfaeb86e4a0
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext