General
-
Target
QUOTATION.exe
-
Size
508KB
-
Sample
220131-nq5m1shfd7
-
MD5
54cabe3124bae52f13dd9e772b6361e0
-
SHA1
8c80ce3af1573e5d48d536e112d5845aeee426f9
-
SHA256
780f32cb42bd11ab9ae87d365c55c098051dba2784921ab5f7f7fd7d4ebe0c26
-
SHA512
ac746875c4c919450c1955c8830d79585cd03ae87351064ab3453e549807c4e6abf9d4ae9ae383ed3a4b6062e172bfcf003966734f8c414fb00235e17539f39d
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
QUOTATION.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
formbook
4.1
n2t4
livingthroughthechaos.net
videobuzzmedia.com
felineformulas.com
theorganicbees.com
bizoeflow.com
gtbcked.com
immortalapenft.com
pacherasrl.com
defunddrip.black
fromefarm.com
newmedicalnetwork.com
nikosblue.com
kaecfu.online
arcane-stylish.com
7ox.info
osamaabuzawayed.com
noemielatour.com
baccaratjava.com
latinfoodandwinefestival.com
magiclandstudios.com
shazpe.com
businessmanbazar.com
lifewithkatiewright.com
themarketingideascatalog.com
nickbrizhoops.com
esportsgamertv.com
delinointeriores.com
connotatetechnologies.net
cybomatic.cloud
correctmakling.site
thammydora.com
ageingwellhomecare.com
fleetwoodjobshop.site
jakulo.com
drbaren.com
newpointstudio.com
yxuqamnj.com
spiritsyncing.net
hy963app.com
rnp-trading-lukoil.com
bowlesuniverse.com
fumigacionesecouniversal.com
vulvip.com
heppi.pro
preetiplease.com
gemini-hk.icu
allyazek24.xyz
blackbratapparelcompany.com
immersivenm.com
mystoragewarehouse.com
dvjdob.icu
mecanicadesuelosrancagua.one
cayugacommunitysolar.com
parizes.site
vpsincnas.com
tattoo-marketplace.online
garadapatngklgamazon.com
signa.info
simplegourmetpa.com
quintanaroopt.com
studio-goettingen.com
brimhi.com
fabula-glass.com
1049hubertrd.com
faireez.club
Targets
-
-
Target
QUOTATION.exe
-
Size
508KB
-
MD5
54cabe3124bae52f13dd9e772b6361e0
-
SHA1
8c80ce3af1573e5d48d536e112d5845aeee426f9
-
SHA256
780f32cb42bd11ab9ae87d365c55c098051dba2784921ab5f7f7fd7d4ebe0c26
-
SHA512
ac746875c4c919450c1955c8830d79585cd03ae87351064ab3453e549807c4e6abf9d4ae9ae383ed3a4b6062e172bfcf003966734f8c414fb00235e17539f39d
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-