General
- Target NEW ORDER.scr
- Size 818KB
- Sample220129-lzhthaabf7
- SHA256 f2d58fc68302fb9cfc6ba93ca4f01f17c8baf7fef4cdfef59638e61fa4f54ad4
- MD5 7735f514bfc4111a49a0ed6078206788
- SHA1 766933ccc287d5734ae351ca42fcb5ee6c1bd56f
- SHA512 a566f4372171517129aed5370937dfe6abb23aec230bb4ecefb63ec62c0df414d9708e7e8f97ece1c3ab6de5c64c9d6d7460d34b18e9199370e253e06cf18bae
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER.scr
Resource
win7-en-20211208
Malware Config
Extracted
-
formbook
-
4.1
-
s16r
-
kellieroysellsnc.com
-
valleylowvoltage.com
-
mltuo900.xyz
-
visitingpuntacana.com
-
weiwushi.com
-
austintechjob.com
-
rxstarcbd.com
-
shopstudioesi.com
-
filetto-server.xyz
-
relianceltdbnk.com
-
unethical.world
-
yedd.store
-
esthershhs.com
-
magaddis.com
-
scenicdrivetours.com
-
123gest.com
-
2020mortagelifeinsurance.com
-
faceinle.com
-
integritymarking.com
-
alfatoto.xyz
-
nwebcam.com
-
wu8hx5cpgl3i.xyz
-
shiningbellsscrubs.com
-
visitorego.com
-
101-bg.com
-
blaccforestsociety.com
-
caremeinternational.com
-
devanharle.com
-
d2h7e3q.xyz
-
excaliburteacher.com
-
tatouagejaponais.com
-
gallematias.com
-
sobacoffee.com
-
thetravelbanana.com
-
artandmag.com
-
swoutfit.com
-
pecintaotomotif.com
-
realkezorup.xyz
-
shoplitumi.com
-
taylorhudak.net
-
prime-links.net
-
openvmsdatabasemigration.com
-
digitaltradingforex.com
-
vocenoazulnovamente.com
-
ertyuhjul.xyz
-
yunshangzhongwen.com
-
psalm686.com
-
breastfeedcare.com
-
matjaralmona.com
-
insurancesalesreps.com
-
octets.biz
-
reviewopenaccess.biz
-
parvatakrachka.com
-
vector-center.xyz
-
hatchvi.com
-
hmamah.com
-
a-home4you.com
-
lq-safe-keepingyuchand91.xyz
-
amplexus.xyz
-
h3ssel.xyz
-
aims-colorado.com
-
clickforrichesvision.com
-
belcantato.com
-
minidentalimplantsdaytonoh.com
-
mlniubi.xyz
Targets
-
- Target NEW ORDER.scr
- Size 818KB
- SHA256 f2d58fc68302fb9cfc6ba93ca4f01f17c8baf7fef4cdfef59638e61fa4f54ad4
- MD5 7735f514bfc4111a49a0ed6078206788
- SHA1 766933ccc287d5734ae351ca42fcb5ee6c1bd56f
- SHA512 a566f4372171517129aed5370937dfe6abb23aec230bb4ecefb63ec62c0df414d9708e7e8f97ece1c3ab6de5c64c9d6d7460d34b18e9199370e253e06cf18bae
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext