General
- Target 3247f8db646f5e524df32ea6a29e33d9
- Size 801KB
- Sample220215-zyandsaca9
- SHA256 921628eeb649a7c9f45ccb4b95ccecba8a76e273a88bdf8478c7e63cef2fb10a
- MD5 3247f8db646f5e524df32ea6a29e33d9
- SHA1 2dd2157329e16150e476e058224f77bf0c2d1abc
- SHA512 c3a458a5d4500ddb609c4b475485050cb4e7bc89704976f460c60222c56b2b0ead7ea00f3ca689a8cba8089b6b7650d680759d3db911011a6ecfdc89210b4916
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
3247f8db646f5e524df32ea6a29e33d9.exe
Resource
win7-en-20211208
Malware Config
Extracted
-
formbook
-
4.1
-
vy44
-
csdvehgry45y.com
-
letstayhome.com
-
davidfrechen.com
-
atticusandjules.com
-
meandbond.com
-
paar-fotoshooting.com
-
twboosterhq.com
-
shivamehandiarts.com
-
typhoonlogistics.net
-
vintagevowswedding.com
-
brittanymays.com
-
dreamylineart.com
-
vimspaces.com
-
thakurmosai.com
-
88-wealth.com
-
betsycousins.com
-
nationalcsno.online
-
mobileblockchainsolution.com
-
flymetothemundo.com
-
shopsuplementos.site
-
soflojo.com
-
diy-quest.com
-
stixxgaming.com
-
rdbem.online
-
sellyourhousefastcfl.com
-
briggsev.com
-
brushycreekstudios.com
-
balistrericlearance.com
-
petrichorpus.com
-
licencepay.com
-
mouthfodder.com
-
sessionflux.xyz
-
smilesonrisas.com
-
jareware.com
-
arcoirisdulceria.com
-
sydxyxj.com
-
1o4yb6.com
-
51335o.com
-
theastralmuse.com
-
artisticgallery.net
-
cameleonproduction.com
-
iauui.com
-
dathomirlaboratories.com
-
aspanishsense.com
-
pxbpju.site
-
poxmad.online
-
competitiverangesolutions.com
-
gxklla.com
-
brick-shack.com
-
ytoy88.com
-
alrwfb.icu
-
robertfresses.com
-
plc-kyoto.com
-
shreyatadas.com
-
thetimess.com
-
eznftrade.com
-
fortiar.icu
-
snmtco.store
-
productshere.site
-
cqqsgsp.com
-
appsewalesxrecspt.com
-
hgaconsultores.net
-
tgtvi.com
-
asesorialaboralms.com
-
dronemaneuversystems.com
Targets
-
- Target 3247f8db646f5e524df32ea6a29e33d9
- Size 801KB
- SHA256 921628eeb649a7c9f45ccb4b95ccecba8a76e273a88bdf8478c7e63cef2fb10a
- MD5 3247f8db646f5e524df32ea6a29e33d9
- SHA1 2dd2157329e16150e476e058224f77bf0c2d1abc
- SHA512 c3a458a5d4500ddb609c4b475485050cb4e7bc89704976f460c60222c56b2b0ead7ea00f3ca689a8cba8089b6b7650d680759d3db911011a6ecfdc89210b4916
- MD5 SHA1 SHA512
-
Formbook Payload
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext