General
- Target ae9b28ae83a226e24306f1f2c05f00f4.exe
- Size 523KB
- Sample220113-tdf2sabcd9
- SHA256 d07c78ca44c6b0f13f00ecb09e9716eb8d85d6a9baac7eca18c08477f9972840
- MD5 ae9b28ae83a226e24306f1f2c05f00f4
- SHA1 86d22edd016963e944ac196c2231b80c760d35fd
- SHA512 a03fffda49ebf9d8dced55d22dd8b19e07c0ccec330422a445b47f33f902ed702695939637f81383fe2664bc0ba7624161b447fe9501423d4b27c316770f30c9
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
ae9b28ae83a226e24306f1f2c05f00f4.exe
Resource
win7-en-20211208
Malware Config
Extracted
-
formbook
-
4.1
-
m1x9
-
gateareus.com
-
cjhzgxkl.com
-
wa6amzrmtogk.xyz
-
xnowrndsz.com
-
gcqtds.com
-
katnkaboodle.com
-
wk7b2vu20mku.xyz
-
therapyledger.com
-
kfarrowllc.com
-
belimobiltuarusakbekasmati.com
-
locofocosubpopulation.xyz
-
ankagyd.com
-
marketgrup.com
-
pophaircare.com
-
ilsup.com
-
acupuncture-for-fertility.info
-
hearinghealthcart.com
-
loveyourselfcircle.com
-
tuscaroraarchery.com
-
alephteams.com
-
scootersco.com
-
singulariousasiconference.com
-
normaroup.com
-
lojajolly.online
-
pornvideoq.site
-
zude8.com
-
lixodruj.xyz
-
currentevents-global.com
-
crazydiscountgolf.online
-
marwasdounuts.com
-
bathtubresurfacingofraleigh.com
-
skindredspirits.com
-
camilamurilo.com
-
vkmediamanagement.com
-
theerye.com
-
brandonandfriends.com
-
atlbimmer.com
-
parentingz.com
-
xn--jk1bkpy5lhpiizcvrg2yc.com
-
zaizaicorp.com
-
encrypt-file.com
-
ontariohondaservice.com
-
dejgunowka.com
-
jrsclubgear.com
-
cospamietam4.xyz
-
qzhyfm.com
-
veronique-murzeau.com
-
akhirnya-nikah.com
-
beesafebackpacks.com
-
kawasha.com
-
myworkshop.xyz
-
slsj581.com
-
jaesbeauty.com
-
tikahiri.com
-
people4people103.rest
-
jiali8889.xyz
-
getgiveaway2.com
-
properlynotgrain.xyz
-
martinsmoments.com
-
takalyj.xyz
-
mainemilitarysurplus.com
-
malta-ps.com
-
bigandlittletechnologies.com
-
bwanas.biz
-
aa7rsnj.xyz
Targets
-
- Target ae9b28ae83a226e24306f1f2c05f00f4.exe
- Size 523KB
- SHA256 d07c78ca44c6b0f13f00ecb09e9716eb8d85d6a9baac7eca18c08477f9972840
- MD5 ae9b28ae83a226e24306f1f2c05f00f4
- SHA1 86d22edd016963e944ac196c2231b80c760d35fd
- SHA512 a03fffda49ebf9d8dced55d22dd8b19e07c0ccec330422a445b47f33f902ed702695939637f81383fe2664bc0ba7624161b447fe9501423d4b27c316770f30c9
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext