General
- Target c35b8d27f7ed050e3bc31e536a0e389f
- Size 822KB
- Sample220218-nyfnvscea2
- SHA256 c8dfddd4c5d6b2c5ee3c4f74651673e6975c4ae05d7aece0c08e40c2ad92db7e
- MD5 c35b8d27f7ed050e3bc31e536a0e389f
- SHA1 be9dddd5fac8482212030b5f6cbb04f1190a6113
- SHA512 cd012d1563cd6f35444aa3a6954de8946e463a793af33a5711f7d08f00ed3fd225e6a67bcccf517aac582d99520909be7e645a385c181f5f6b38f72165ac5a01
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
c35b8d27f7ed050e3bc31e536a0e389f.exe
Resource
win7-en-20211208
Malware Config
Extracted
-
formbook
-
4.1
-
vy44
-
csdvehgry45y.com
-
letstayhome.com
-
davidfrechen.com
-
atticusandjules.com
-
meandbond.com
-
paar-fotoshooting.com
-
twboosterhq.com
-
shivamehandiarts.com
-
typhoonlogistics.net
-
vintagevowswedding.com
-
brittanymays.com
-
dreamylineart.com
-
vimspaces.com
-
thakurmosai.com
-
88-wealth.com
-
betsycousins.com
-
nationalcsno.online
-
mobileblockchainsolution.com
-
flymetothemundo.com
-
shopsuplementos.site
-
soflojo.com
-
diy-quest.com
-
stixxgaming.com
-
rdbem.online
-
sellyourhousefastcfl.com
-
briggsev.com
-
brushycreekstudios.com
-
balistrericlearance.com
-
petrichorpus.com
-
licencepay.com
-
mouthfodder.com
-
sessionflux.xyz
-
smilesonrisas.com
-
jareware.com
-
arcoirisdulceria.com
-
sydxyxj.com
-
1o4yb6.com
-
51335o.com
-
theastralmuse.com
-
artisticgallery.net
-
cameleonproduction.com
-
iauui.com
-
dathomirlaboratories.com
-
aspanishsense.com
-
pxbpju.site
-
poxmad.online
-
competitiverangesolutions.com
-
gxklla.com
-
brick-shack.com
-
ytoy88.com
-
alrwfb.icu
-
robertfresses.com
-
plc-kyoto.com
-
shreyatadas.com
-
thetimess.com
-
eznftrade.com
-
fortiar.icu
-
snmtco.store
-
productshere.site
-
cqqsgsp.com
-
appsewalesxrecspt.com
-
hgaconsultores.net
-
tgtvi.com
-
asesorialaboralms.com
-
dronemaneuversystems.com
Targets
-
- Target c35b8d27f7ed050e3bc31e536a0e389f
- Size 822KB
- SHA256 c8dfddd4c5d6b2c5ee3c4f74651673e6975c4ae05d7aece0c08e40c2ad92db7e
- MD5 c35b8d27f7ed050e3bc31e536a0e389f
- SHA1 be9dddd5fac8482212030b5f6cbb04f1190a6113
- SHA512 cd012d1563cd6f35444aa3a6954de8946e463a793af33a5711f7d08f00ed3fd225e6a67bcccf517aac582d99520909be7e645a385c181f5f6b38f72165ac5a01
- MD5 SHA1 SHA512
-
Formbook Payload
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext