General
- Target Racun je u prilogu.exe
- Size 710KB
- Sample211124-y8e57agha5
- SHA256 41469a749da51e8aa7e1ea159041bf74f712dd4f23f076188f547ee0c0f7933f
- MD5 079787bc91a1990b5e57903253c822f4
- SHA1 c6fede48ee4b3839b12a46b1c1e72e602cc7748b
- SHA512 4a9062963f9dba25dc3f19db11d3c2d5bbae7554d98b24fbf6f5a1a6d6320376fd838cdeae0c15621516f46bfb489e79ac39e03c8ec52a9e45562362c3bd436e
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Racun je u prilogu.exe
Resource
win7-en-20211104
Malware Config
Extracted
-
formbook
-
4.1
-
3nop
-
http://www.jakesplacebarbers.com/3nop/
-
videohm.com
-
panache-rose.com
-
alnooncars-kw.com
-
trueblue2u.com
-
brussels-cafe.com
-
ip2c.net
-
influenzerr.com
-
rbcoq.com
-
zzful.com
-
drainthe.com
-
sumaholesson.com
-
cursosaprovados.com
-
genotecinc.com
-
dbrulhart.com
-
theapiarystudios.com
-
kensyu-kan.com
-
dkku88.com
-
tikhyper.com
-
aztecnort.com
-
homebrim.com
-
infinitilamp.com
-
leelegantflower.com
-
floor-space.investments
-
vidasustentavel.online
-
wholehearteddaughters.com
-
vipandeep.com
-
mdwovzrrm.icu
-
592215.com
-
academicplumbing.com
-
bestveganbook.com
-
theservantleader.com
-
nazarickdeveloper.xyz
-
delta-wing.com
-
girlfriendsgarb.com
-
sezyz11.com
-
ca3construction.com
-
smartswitchhomeloan.net
-
luckytwo.agency
-
ministry-of-barbers.com
-
babbageacademy.com
-
informationside.com
-
packapp.net
-
spacecoasthondaevent.com
-
thehealthyimmunereset.com
-
pjcavaliere.info
-
trebdurham.com
-
zhixintonghe.com
-
gon2580.com
-
dottproject.net
-
snakby.com
-
keeponsports.com
-
debbiewilsondesigns.com
-
stagingsolutionsgroup.com
-
forummondialdelamerbizerte.com
-
garnier.red
-
tempestchs.com
-
zpxinxi.com
-
jam-nins.com
-
inclusiocg.com
-
msmenders.com
-
whachupichu.com
-
pursemore.com
-
thebusinessfitclub.com
-
scootgotti.com
Targets
-
- Target Racun je u prilogu.exe
- Size 710KB
- SHA256 41469a749da51e8aa7e1ea159041bf74f712dd4f23f076188f547ee0c0f7933f
- MD5 079787bc91a1990b5e57903253c822f4
- SHA1 c6fede48ee4b3839b12a46b1c1e72e602cc7748b
- SHA512 4a9062963f9dba25dc3f19db11d3c2d5bbae7554d98b24fbf6f5a1a6d6320376fd838cdeae0c15621516f46bfb489e79ac39e03c8ec52a9e45562362c3bd436e
- MD5 SHA1 SHA512
-
Formbook Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext