General
-
Target
BATCH MCC220601.exe
-
Size
879KB
-
Sample
221028-19k4yaabel
-
MD5
f18e70cad17771781b755ba55846ec36
-
SHA1
749ecb4b9a1f775003b9037f6ebee88df8cd2c31
-
SHA256
ffdf5023253f85c17296dbb3a31d959b54b67c6db569b4b0f3a69eeeca76e112
-
SHA512
47b73d81e3bcc442b791db4fe51ae98b4086f14e3d97337bbdf851f0ead6417909dd6d7c0a9d5535c6eea5d25f173d4677d4f950365c3b0243a48b2a5d3dff91
-
SSDEEP
12288:9Wh702iNp6Rdy4vnVNGEu9zLmqzjCFGwwExvOCmIh5/C8WQGJu9TRrDV530:11SdFVBCzjCFfJBrr/COKu9tnV5
Static task
static1
Behavioral task
behavioral1
Sample
BATCH MCC220601.exe
Resource
win7-20220812-en
Malware Config
Extracted
formbook
4.1
ss63
heartgroupfurniture.com
petruskraftshop.net
bernesespirit.com
minulgul.com
canoncashier.com
britishsaschool.com
frau-kruppa.net
cj-zn.com
derdggyih5ctsc.kred
xvvbros.pics
unacucinadipasta.com
brandsalted.com
pledialinks.xyz
teslamoto.shop
doxycyclin.monster
nuflowalexandriava.com
eliteinfratech.com
laymember.net
bestprobiotics.online
diversifiedpower.international
autorenda.fun
ciseaux-a-bois.com
elsaltodelfraile.online
dikingte.cyou
gaosan123.com
gxgvdd.com
iz0maopis0o2p3.kred
mcc-xia55pjs.com
vnhanh.net
hey-hee.com
ahxinying.com
blanerussell.com
happytopia.net
pennburyfarm.shop
a5t3.cyou
wbhgxs027f.vip
mzzmj.com
grooming.asia
successful101.com
dagatructiephd.com
thinkphysiotherapy.com
thenewburaimohs.com
leedart.com
folsomappraisers.com
hindibizz.tech
cctrmo.com
blainrussell.com
pop-up-flat.com
xscnc.net
happykidsindonesia.com
nsber.store
mediqhealthcare.com
allinvest-swiss.com
chaokeke.com
littleyeoneo.com
yapek.xyz
9b505.app
dream.parts
vexpertsonline.com
bbpo11.com
candyclub7.world
fadesrus.net
poolsigncase.com
offplan.realestate
khetikissani.com
Targets
-
-
Target
BATCH MCC220601.exe
-
Size
879KB
-
MD5
f18e70cad17771781b755ba55846ec36
-
SHA1
749ecb4b9a1f775003b9037f6ebee88df8cd2c31
-
SHA256
ffdf5023253f85c17296dbb3a31d959b54b67c6db569b4b0f3a69eeeca76e112
-
SHA512
47b73d81e3bcc442b791db4fe51ae98b4086f14e3d97337bbdf851f0ead6417909dd6d7c0a9d5535c6eea5d25f173d4677d4f950365c3b0243a48b2a5d3dff91
-
SSDEEP
12288:9Wh702iNp6Rdy4vnVNGEu9zLmqzjCFGwwExvOCmIh5/C8WQGJu9TRrDV530:11SdFVBCzjCFfJBrr/COKu9tnV5
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-