General
-
Target
7357d3e9a33b53dcaf335fecb11100acf0fbeeec2ebf668634de7cd1ba931ae1
-
Size
400KB
-
Sample
220217-m3vg5sbad9
-
MD5
cb5cd9f8250eaf3861f8774f431032b4
-
SHA1
1de8f273480f80f18d070f1f71aa722923759137
-
SHA256
7357d3e9a33b53dcaf335fecb11100acf0fbeeec2ebf668634de7cd1ba931ae1
-
SHA512
f7b4bc3996fee5fa1606a85f3d3cce6a1dbd6f14a133c81db0061b91528fc36c9856bd684b5d111ad387fff539720391fc2afd52c3b5803a7e192471a21e74cc
Static task
static1
Malware Config
Extracted
formbook
4.1
k2i4
apehangersbikersgang.com
lhcgrou.com
diveidf.com
timtas.store
jadebody.club
iamjbrussell.com
fwfuv.icu
picchealth.net
batuair.com
z58609.com
punarecotech.com
a-oct.com
xn--wmq0c1qt9mcxhxjkp16a.top
district99.net
5dcoding.com
aripagripoff.biz
abtheagent.com
betterskincareco.com
jsskylight.com
deviseoffice.com
talentbrothers.com
metacharade.com
cymbpz.icu
saveusclothing.com
alidmpt.com
vyoala.icu
dollarswithdemitri.com
trustbitcoin.city
quadcoptertransportation.com
sx1887.com
ngtr07.com
naturarerum.store
deliciousvegetarianfood.com
378wn.net
lxqjm.com
magicfountain.club
in-novating.com
khokhovula.net
antisecuritysecurityclub.com
vantor.xyz
liumenshan.com
eltfreight.com
garmi-family.com
maridenby.com
theaplusacademy.net
roseintro.online
allthingconsideredbykeki.com
ltlv-ci.com
goel-exports.com
keisanscale.com
fewind.com
tcenjoyers.com
staysugoi.com
natureshealthshop.net
jbsgou.com
polarsc.net
chesapeakebayoyster.com
wyrmzine.com
makeid.online
cityhom.com
accurateamericaroofing.com
peapds.com
punterstoplock.store
startupmentorsquad.com
ruiquanjm.icu
Targets
-
-
Target
7357d3e9a33b53dcaf335fecb11100acf0fbeeec2ebf668634de7cd1ba931ae1
-
Size
400KB
-
MD5
cb5cd9f8250eaf3861f8774f431032b4
-
SHA1
1de8f273480f80f18d070f1f71aa722923759137
-
SHA256
7357d3e9a33b53dcaf335fecb11100acf0fbeeec2ebf668634de7cd1ba931ae1
-
SHA512
f7b4bc3996fee5fa1606a85f3d3cce6a1dbd6f14a133c81db0061b91528fc36c9856bd684b5d111ad387fff539720391fc2afd52c3b5803a7e192471a21e74cc
-
Formbook Payload
-
Suspicious use of SetThreadContext
-