General
-
Target
deeed37a10d7707ee60bcaec58b745252a61f4554a1a41a5bd8555bff054b6e0
-
Size
351KB
-
Sample
220521-ce9xtagggq
-
MD5
a7e2a6ff0627a58b9b460dda9a2567ef
-
SHA1
f309416b674193104b1ef226e5e613928e9c47a2
-
SHA256
deeed37a10d7707ee60bcaec58b745252a61f4554a1a41a5bd8555bff054b6e0
-
SHA512
47de3477dbaa1cea7c887761b20c71a0b285f442f89bfd8127faa6af09decb7afb893ee1f71fc022db42e101a49235354cfabb758f9adc294219798dde184e2a
Static task
static1
Behavioral task
behavioral1
Sample
ADHOC RFQ-97571784.exe
Resource
win7-20220414-en
Malware Config
Extracted
formbook
4.0
jac0
chatbot-consulting.com
alynt.info
saudiarabianwomenjobs.biz
kingtour.info
poshlacore.com
hypnosetherapist.com
tampahurricanrelief.com
qqgan16.com
tag-designco.com
viaeviastaff.com
unhosting.today
apple-request.info
whitesauce.net
627evq.info
mygolfingwarehouse.com
materiaprojects.com
rj-ipt.net
cordences.com
invescoapconference.com
supplementcult.com
flfsd.net
rasa36.com
nicorise.com
xdomainz.com
onlinemoneyguru.com
playupmusic-mail.com
zpdqd.com
convertproof.net
disasterreadyclub.com
1t1threeout.men
prestijoto.net
mining-tec.com
kleinpelteam.com
bbslsj.info
krebsoottthrobseousfleis.win
homeinandalucia.com
gillespievideocreations.com
zbktw.com
blogs-caraibcreolenews.com
huitiemeciel.com
rodrigodahora.com
salon-lewalo.com
webstudio20.com
realtheproducer.com
sistereasyweed.com
belendeazcarate.com
computerrepairtacoma.com
cbrenp-crosspoint2030.com
krystaeducatrice.online
gastro-va.com
1t1sixtake.men
birimmarble.com
springfieldrise.community
hachette-service.com
fbhlpsn.com
hotmessanglerapparel.com
stephenwinterphoto.com
xn--fhq334dxx9a.net
acctedu.com
huafeng.biz
united-transfer.com
toppayingsites.info
sc2zhibo.com
repsolenergyinc.com
regulars5.com
Targets
-
-
Target
ADHOC RFQ-97571784.bat
-
Size
405KB
-
MD5
2d2db3a8698206d1e4b0928f4910de8c
-
SHA1
eb735b973979d0a6c3dbd32638c84990c4503a37
-
SHA256
3b7dc89103d8c49eea88bd302c37e6b9c1f1ae13bdd38c9ff9709568b9f56e3b
-
SHA512
5e9ce4fc978df75833069dbdd0de93ef07d2141b3facbee7e69e7177c02d5fe4b7e65e348d7179997d726961905e655fa9644652bf208ff6f47c798ef4683a11
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-