General
- Target scan_0010.pif
- Size 324KB
- Sample211202-s77k6adcc7
- SHA256 f014d9e6a00f7dab0718e5320ebc0185b63c080ab7b3e9d49f0f1eea48c0c09a
- MD5 71fcec0f4a06120aab9d295ce1f56257
- SHA1 a59882ca43ea0cd8c68b3da6f329ee46a38f788a
- SHA512 f7d76149b249e0e4de894a0dc05f742952d597a34ea45e200367d7bbf85807ade9b611bcbe5264e1e24fb909bde61ab45103aa24827517632fff42222502df12
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
scan_0010.pif.exe
Resource
win7-en-20211104
Malware Config
Extracted
-
formbook
-
4.1
-
st28
-
http://www.zymberzuzaku.com/st28/
-
ratusejagad.com
-
huabei86.com
-
bolan55.com
-
re-designingwork.com
-
doanhyduc.net
-
hutbephot-hanoi2.online
-
gamenfr.net
-
keystosmile.com
-
halwyat.online
-
kliktshirts.com
-
nasirqadri.com
-
designinframe.com
-
workation.global
-
ges-llc.biz
-
ropsstyle.online
-
sociallenzer.com
-
daxvly.xyz
-
paradigmtrading.net
-
niceassetnsirs.com
-
enzofineart.com
-
nfrsy.com
-
schooloftutorials.com
-
frankietrees.com
-
shopquick.site
-
cumcrate.com
-
achieveacuity.com
-
ridethenorth.travel
-
goroorb.com
-
businesscreditassociates.com
-
movies-meta.com
-
freetowing.website
-
kreditsalam.site
-
bostonheraldnie.com
-
lotusmanpower.solutions
-
qpal.tech
-
xn--cck7c3h.net
-
cutebabyhosky.com
-
cm-customs.com
-
tiqka.com
-
sustavitin.site
-
beregg.com
-
schoolgain.com
-
masterchefverse.com
-
tiribekko.com
-
controller24.com
-
escapemeals.com
-
rbap.info
-
leathermartuk.com
-
sumatureforma.com
-
prettyposseapparel.com
-
se9t.com
-
growyoursalesteam.net
-
mikrozaem-online24.store
-
onoffphoto.com
-
goldhawkpottery.com
-
cashpguilty.xyz
-
identityproject.photos
-
kentuckygca.com
-
waterdamageinspection.sbs
-
zinctruckinsurance.com
-
frenchtextbooks.xyz
-
mississippics.com
-
ntrysted.com
-
ubereatsinjurylawyer.com
Targets
-
- Target scan_0010.pif
- Size 324KB
- SHA256 f014d9e6a00f7dab0718e5320ebc0185b63c080ab7b3e9d49f0f1eea48c0c09a
- MD5 71fcec0f4a06120aab9d295ce1f56257
- SHA1 a59882ca43ea0cd8c68b3da6f329ee46a38f788a
- SHA512 f7d76149b249e0e4de894a0dc05f742952d597a34ea45e200367d7bbf85807ade9b611bcbe5264e1e24fb909bde61ab45103aa24827517632fff42222502df12
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext