General
- Target 4d42d3a6f8a998773e5d3b8d31acfac3.exe
- Size 408KB
- Sample220112-m4kpbscch6
- SHA256 28323d3c8fd1339a7d4f0ebad6ff377545e88c15fdca9b2f21cdd7c72c07622e
- MD5 4d42d3a6f8a998773e5d3b8d31acfac3
- SHA1 03a852169aa74f17bb9ee2ce5513246df22093e6
- SHA512 e1260c21318b047362c5bff78958cb100f3e5f25107fe489a6557517e3b0064d14faea35be3fe910fd682758e781d0f6950df95eb7b9a5b7111c9a432b3cc024
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
4d42d3a6f8a998773e5d3b8d31acfac3.exe
Resource
win7-en-20211208
Malware Config
Extracted
-
formbook
-
4.1
-
m1x9
-
gateareus.com
-
cjhzgxkl.com
-
wa6amzrmtogk.xyz
-
xnowrndsz.com
-
gcqtds.com
-
katnkaboodle.com
-
wk7b2vu20mku.xyz
-
therapyledger.com
-
kfarrowllc.com
-
belimobiltuarusakbekasmati.com
-
locofocosubpopulation.xyz
-
ankagyd.com
-
marketgrup.com
-
pophaircare.com
-
ilsup.com
-
acupuncture-for-fertility.info
-
hearinghealthcart.com
-
loveyourselfcircle.com
-
tuscaroraarchery.com
-
alephteams.com
-
scootersco.com
-
singulariousasiconference.com
-
normaroup.com
-
lojajolly.online
-
pornvideoq.site
-
zude8.com
-
lixodruj.xyz
-
currentevents-global.com
-
crazydiscountgolf.online
-
marwasdounuts.com
-
bathtubresurfacingofraleigh.com
-
skindredspirits.com
-
camilamurilo.com
-
vkmediamanagement.com
-
theerye.com
-
brandonandfriends.com
-
atlbimmer.com
-
parentingz.com
-
xn--jk1bkpy5lhpiizcvrg2yc.com
-
zaizaicorp.com
-
encrypt-file.com
-
ontariohondaservice.com
-
dejgunowka.com
-
jrsclubgear.com
-
cospamietam4.xyz
-
qzhyfm.com
-
veronique-murzeau.com
-
akhirnya-nikah.com
-
beesafebackpacks.com
-
kawasha.com
-
myworkshop.xyz
-
slsj581.com
-
jaesbeauty.com
-
tikahiri.com
-
people4people103.rest
-
jiali8889.xyz
-
getgiveaway2.com
-
properlynotgrain.xyz
-
martinsmoments.com
-
takalyj.xyz
-
mainemilitarysurplus.com
-
malta-ps.com
-
bigandlittletechnologies.com
-
bwanas.biz
-
aa7rsnj.xyz
Targets
-
- Target 4d42d3a6f8a998773e5d3b8d31acfac3.exe
- Size 408KB
- SHA256 28323d3c8fd1339a7d4f0ebad6ff377545e88c15fdca9b2f21cdd7c72c07622e
- MD5 4d42d3a6f8a998773e5d3b8d31acfac3
- SHA1 03a852169aa74f17bb9ee2ce5513246df22093e6
- SHA512 e1260c21318b047362c5bff78958cb100f3e5f25107fe489a6557517e3b0064d14faea35be3fe910fd682758e781d0f6950df95eb7b9a5b7111c9a432b3cc024
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext