General
-
Target
QUOTATION.exe
-
Size
761KB
-
Sample
220126-tbsykafda8
-
MD5
b7cd2e625aa05005e2326e5e6158a560
-
SHA1
420a83cd1c1703fbf7aeb8b7e51c46c407e5d6b5
-
SHA256
f08bb3738306349fa7b9217837de2e959cba48fdceb4ada3d3b58533bb3527f2
-
SHA512
c53ea74a3da53f82bc12bbe0d10a8050d8747737b3cff118465357c278d05b7ddf185b4f53759e636cf7da6000a6036220f1d3df3faa15b00e13f6c33ba18b30
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win7-en-20211208
Malware Config
Extracted
formbook
4.1
e10p
pompland.com
hybikebbs.com
sacramentocommercial.net
dixietales.com
rakan-group.com
wanmeipp.com
brandonwestjacksonville.com
jschenjitong.com
sedarous.com
cheapflightsandhotels.net
effectivehomeloans.com
haru-kun.com
pure-heartfelt.com
tlbdsm72.com
avantcarmomento.com
flighthonestpaulvids.com
xn--ok0b350biyc97gvlg.com
3bmmxvn.life
force-win.info
shvecarskiy-stil.store
youlikemassagespa.com
maniatr.info
tvephoto.com
makewebsites44.com
jenniferbaernutrition.com
surreyconectedcare.com
whattogetme.com
dranbok.xyz
nogza.com
lvsssj.com
maison-etoile.com
freemortgagetraining.com
aishastarsfabric.com
secrettextprime.com
fluidra-emea1.com
danstpaulcomedy.com
uklredygwe.com
mkto-nld1040159.com
lucidchains.com
ameiting.com
dipreemprende.com
fgc-limited.com
aggarudyog.com
shatoyaharrisenterprises.com
alpha-df.com
mversehollywood.com
espertoaml.com
yomamaverse.com
kidsroomfan.com
skill-course.com
quickbanknet.com
yelangrenti.com
marmocn.com
cattleyaproperties.com
cursosoficialdesites.com
utkrashtlandbase.com
percysangles.com
lesoq.com
brainhacksex.com
tabledumarais.com
30daysofpurposechallenge.com
yamanteknikbursa.com
sweetysmoke.com
piletekstil.com
kelqueenskloset.com
Targets
-
-
Target
QUOTATION.exe
-
Size
761KB
-
MD5
b7cd2e625aa05005e2326e5e6158a560
-
SHA1
420a83cd1c1703fbf7aeb8b7e51c46c407e5d6b5
-
SHA256
f08bb3738306349fa7b9217837de2e959cba48fdceb4ada3d3b58533bb3527f2
-
SHA512
c53ea74a3da53f82bc12bbe0d10a8050d8747737b3cff118465357c278d05b7ddf185b4f53759e636cf7da6000a6036220f1d3df3faa15b00e13f6c33ba18b30
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-