General
- Target triage_dropped_file
- Size 699KB
- Sample220804-r7kwqagae9
- SHA256 afa4507bce58af7b4050b41a86eabf424ac0e89a69b8a962c1dd58a1620457b5
- MD5 d9a78b37ec78ac0e517c6dcbfd931357
- SHA1 831d402d785af292cd0187a8de0f44c4eb9a5f0a
- SHA512 08ac3f444c7e71292dd457694002b53dcaeda092468c906eafe2878a17378862f7f0d31f857285045b28b64d68c7d5a6199390eed5b9e93b1064783d58b5494c
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
triage_dropped_file.exe
Resource
win7-20220718-en
Malware Config
Extracted
-
formbook
-
4.1
-
gu5d
-
blevvv.com
-
yoy01.com
-
balkhmarketing.agency
-
gangguanchina.net
-
0f0t6l.space
-
trump-news.com
-
hymanpullan.online
-
westsernschools.com
-
yourturdburglars.com
-
exitplanning101.com
-
vetsflyfree.xyz
-
sedist.net
-
bestkinopoisk.com
-
maccaverns.com
-
434960.com
-
mbyestudio.online
-
goldenagemininggroup.com
-
mintdomainz.xyz
-
www2823s.net
-
smartbeds-lt-2022.life
-
newstz.online
-
aireandco.com
-
guangguan.net
-
vizeciyim.com
-
getceylon.com
-
globalgolfing.store
-
auburnselectstyle.com
-
thundervetclinic.com
-
botinf.space
-
bumpcard.online
-
tistinstitute.com
-
anguillasailingschool.com
-
bronhr.com
-
2326285.com
-
kggddwu.icu
-
asp1641.icu
-
gsolartech.com
-
kongbao01.com
-
risecityswim.com
-
zhengyangtd.com
-
slottervipjp.xyz
-
hsyj3.com
-
thepediatricianskitchen.com
-
saharalfajar.com
-
stampedzhane.com
-
primacosta.com
-
prosolum.com
-
betaber.store
-
bancobipiemmeassicurazioni.net
-
lzty188.com
-
shinkyuseitai-haru.com
-
lawsonvineyards.com
-
essentiaschool.com
-
finearts-decor.com
-
mrbinbags.com
-
tayna.mobi
-
state-halyk.info
-
heziah.xyz
-
tukeza.com
-
scienf.com
-
camillehanson.com
-
simaanchalkhabar.press
-
nuannuanhehe.com
-
myaccvountaccess.com
-
casinox-ki.xyz
Targets
-
- Target triage_dropped_file
- Size 699KB
- SHA256 afa4507bce58af7b4050b41a86eabf424ac0e89a69b8a962c1dd58a1620457b5
- MD5 d9a78b37ec78ac0e517c6dcbfd931357
- SHA1 831d402d785af292cd0187a8de0f44c4eb9a5f0a
- SHA512 08ac3f444c7e71292dd457694002b53dcaeda092468c906eafe2878a17378862f7f0d31f857285045b28b64d68c7d5a6199390eed5b9e93b1064783d58b5494c
- MD5 SHA1 SHA512
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext