General
- Target DHL_AWB_NO_#907853880911.exe
- Size 751KB
- Sample220801-skk4msbehj
- SHA256 528eeb06e53ab90b33bb403f8b5b89c614c1ceeccbcb18429457dd69821d52cb
- MD5 b51d533af3d1706b32a3c813600296d0
- SHA1 670e3caad0d6b136496081ae739862b217e196aa
- SHA512 444b598bebc549e5e05d82e2d81e3b940a20257c26dd881c70402f77a5a69d05f2dc09918efd412a75d71de481f538b0e6e75c2f698e1ea5704c3498b93e6499
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
DHL_AWB_NO_#907853880911.exe
Resource
win7-20220718-en
Malware Config
Extracted
-
formbook
-
4.1
-
s0s2
-
stripe-forecast.com
-
perfectingnextstage.com
-
primarole.com
-
nonnydesigns.com
-
wordsofweightandlevity.com
-
mafleursam.com
-
hardwarepicker.tech
-
minex-intl.com
-
thenextbigtech.net
-
rabeproject.com
-
sticktogracestudio.com
-
releve.space
-
readoku.net
-
carings.net
-
nasdaq-ex.store
-
au-techng.com
-
thethoughtgenius.com
-
how-to-learn-languages.net
-
kitabisabelanja.com
-
awndka.xyz
-
bretholdings.com
-
boscue.com
-
titantechmail.com
-
jadacomercializadora.com
-
shirtgse.online
-
derechoromano.com
-
yatirimtamam.com
-
gektolicompany.xyz
-
skyglowtech.com
-
67f5ead1a275.info
-
emnopgroup.com
-
lermontov.online
-
roshmary.com
-
goodandperfectgift.com
-
landliner.taxi
-
bhui7.com
-
barq-id.com
-
thevirtualcafe.net
-
176bwcx.com
-
zorbaplus.com
-
zzbb8899.xyz
-
magictvshow.com
-
serengetifadhions.com
-
ryzcn.com
-
amsordglobal.com
-
biznes-poznan24.xyz
-
globalepic10x.com
-
carrotshelter.com
-
keiwaseitai.online
-
energyecuador.net
-
kinsgtonbrass.com
-
cankaoao.com
-
mybullion.net
-
zjzcmy.net
-
businedstrack.com
-
mayipaimai.com
-
minijob-duesseldorf.net
-
gcpropolis.com
-
liwoo.top
-
glitzye.com
-
doca29.site
-
joselynbaezs.com
-
purchase614210.com
-
wojiayouxuan.com
-
dailycuatudong.com
Targets
-
- Target DHL_AWB_NO_#907853880911.exe
- Size 751KB
- SHA256 528eeb06e53ab90b33bb403f8b5b89c614c1ceeccbcb18429457dd69821d52cb
- MD5 b51d533af3d1706b32a3c813600296d0
- SHA1 670e3caad0d6b136496081ae739862b217e196aa
- SHA512 444b598bebc549e5e05d82e2d81e3b940a20257c26dd881c70402f77a5a69d05f2dc09918efd412a75d71de481f538b0e6e75c2f698e1ea5704c3498b93e6499
- MD5 SHA1 SHA512
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext