General
-
Target
0b50a75467d375b948edc7bcb6f01b60.exe
-
Size
273KB
-
Sample
211210-qxyt6ahhhm
-
MD5
0b50a75467d375b948edc7bcb6f01b60
-
SHA1
d9d70c204806b74acf34e95e44f5528031e777a6
-
SHA256
b13782a081582cd40a427da82c93035d3a59cd7dffea1e9b3f3821c55fde233c
-
SHA512
267933362fd75201a23c33b075045f564871fe9a8ee3681a515ae1e5abb29686015274919a0db92a33b78d0cc0566bfffde47cd1906834ea912dc298cdc5c7ad
Static task
static1
Behavioral task
behavioral1
Sample
0b50a75467d375b948edc7bcb6f01b60.exe
Resource
win7-en-20211208
Malware Config
Extracted
formbook
4.1
nk6l
http://www.rthearts.com/nk6l/
cbnextra.com
entitysystemsinc.com
55midwoodave.com
ebelizzi.com
khojcity.com
1527brokenoakdrive.site
housinghproperties.com
ratiousa.com
lrcrepresentacoes.net
tocoec.net
khadamatdemnate.com
davidkastner.xyz
gardeniaresort.com
qiantangguoji.com
visaprepaidprocessinq.com
cristinamadara.com
semapisus.xyz
mpwebagency.net
alibabasdeli.com
gigasupplies.com
quantumskillset.com
eajui136.xyz
patsanchezelpaso.com
trined.mobi
amaturz.info
approveprvqsx.xyz
fronterapost.house
clairewashere.site
xn--3jst70hg8f.com
thursdaynightthriller.com
primacykapjlt.xyz
vaginette.site
olitusd.com
paypal-caseid521.com
preose.xyz
ferbsqlv28.club
iffiliatefreedom.com
okdahotel.com
cochuzyan.xyz
hotyachts.net
diamond-beauties.com
storyofsol.com
xianshucai.net
venusmedicalarts.com
energiaorgonu.com
savannah.biz
poeticdaily.com
wilddalmatian.com
kdydkyqksqucyuyen.com
meanmod.xyz
kaka.digital
viewcision.com
wowzerbackupandrestore-us.com
hydrogendatapower.com
427521.com
ponto-bras.space
chevalsk.com
hnftdl.com
nanasyhogar.com
createacarepack.com
wildkraeuter-wochenende.com
uchihomedeco.com
quintongiang.com
mnbvending.com
Targets
-
-
Target
0b50a75467d375b948edc7bcb6f01b60.exe
-
Size
273KB
-
MD5
0b50a75467d375b948edc7bcb6f01b60
-
SHA1
d9d70c204806b74acf34e95e44f5528031e777a6
-
SHA256
b13782a081582cd40a427da82c93035d3a59cd7dffea1e9b3f3821c55fde233c
-
SHA512
267933362fd75201a23c33b075045f564871fe9a8ee3681a515ae1e5abb29686015274919a0db92a33b78d0cc0566bfffde47cd1906834ea912dc298cdc5c7ad
-
Formbook Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-