General
-
Target
new usd order.scr.exe
-
Size
980KB
-
Sample
220919-hwhgsaddd3
-
MD5
e8c67cb6685edd2fbb54a37d7b9dba88
-
SHA1
4c4f3cc52692964a49220a41f0e140dbbd584307
-
SHA256
2a196b3553aa24dfcd7135eade7babf11b08848be050de27e87dc7628a22c6c8
-
SHA512
0847d8d9b319a90f87f044b7933e50de16cc4f013e26b3e5e8ade50933d98371c7b54e4c7c49f3dc5981b659dd72c84197604dab45272a48b9b5cb017f775e0e
-
SSDEEP
12288:BN253xGFF5BqH+0GgtTLfWkNcKu0NmtlCjOVmUvg+BI:BN2lyFnxno6D0okaVPRI
Static task
static1
Behavioral task
behavioral1
Sample
new usd order.scr.exe
Resource
win7-20220812-en
Malware Config
Extracted
formbook
4.1
p94a
wishgrove.com
parqueveiculos.com
spiderwebs.online
chulkanadham.com
cdtuan.net
zxazm.com
payment6528832.xyz
fengtaiol.com
bffsmovie.com
aliceseagerfitness.com
garisluruskonsulindo.website
analytical-gutter.net
ahcq8.com
fenyoga.com
ecleptic.cat
conjurecrafts.com
aquaway.date
apenpokkenschoonmaakbedrijf.com
zgramr.top
boweknives.site
wf825.com
tonysdiary.com
alttxt.space
digz.us
mailim.xyz
chromebarbangkok.com
toyookahana.com
jornalaquadra.net
cloudpackages.online
xfew.top
atherenergy.uk
allentownfilmcrew.com
gym323.com
ballbyball.online
youyiw.com
mehdifarzi.com
dinobro.com
bonanzapratamaabadi.com
trailer.vegas
retro241.space
ecole-universite.com
magentodesigndublin.com
ilovechutney.info
451338.com
vintagewriting.site
008420.com
sussexfoodie.co.uk
matrix-101.com
carolina3dproperties.com
clairecorrie.co.uk
asafosa.xyz
yashpestcontrol.com
keilewn.online
nirmalmirchandani.com
familyibis.sbs
anthropologybythewire.com
invidgekets.xyz
1stconstiution.com
byxre.com
andresraiter.com
1stpartynft.com
25thdayoffer.xyz
nicehaus.space
mhjys.com
muuritutkimus.info
Targets
-
-
Target
new usd order.scr.exe
-
Size
980KB
-
MD5
e8c67cb6685edd2fbb54a37d7b9dba88
-
SHA1
4c4f3cc52692964a49220a41f0e140dbbd584307
-
SHA256
2a196b3553aa24dfcd7135eade7babf11b08848be050de27e87dc7628a22c6c8
-
SHA512
0847d8d9b319a90f87f044b7933e50de16cc4f013e26b3e5e8ade50933d98371c7b54e4c7c49f3dc5981b659dd72c84197604dab45272a48b9b5cb017f775e0e
-
SSDEEP
12288:BN253xGFF5BqH+0GgtTLfWkNcKu0NmtlCjOVmUvg+BI:BN2lyFnxno6D0okaVPRI
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-