General
-
Target
tmp
-
Size
236KB
-
Sample
221219-vzhm6sfe68
-
MD5
aabb09c3690d466afdfbbaeb791a8bc8
-
SHA1
128095dc05c3bdc4c00966f6c11ac79117f44833
-
SHA256
44bf46793f182055af9af6112cfd1236073c6ab0c879d0cffb49154e5c1c85dd
-
SHA512
b63268fa65e1346cfb31c0a0e2fc744c7f62a3b49bf287906562b4fb97f7190798132655ad7d2062c203d28d366cf5f273624b7abeb4446e150aae1f30dcdb65
-
SSDEEP
6144:FkwvQpUiezSv/iMQYDfyZepKpDLd8vG3be2x:EpReuiojyZTLd8Grfx
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
Malware Config
Extracted
formbook
4.1
8rmt
3472cc.com
takecareyourhair.com
kontolajigasd21.xyz
daihaitrinh.net
syncmostlatestinfo-file.info
lovesolutionsastrologist.info
angelapryan.com
rio727casino.com
jjsgagets.com
devyatkina.online
thegoldenbeautyqatar.com
czytaj-unas24live.monster
timepoachers.com
gayxxxporn.site
72308.xyz
kristanolivo.com
hijrahfwd.com
bmfighters.com
alfamx.website
handfulofbabesbows.com
nationalsocialism.link
mega-recarga-arg.com
rytstack.com
kfav77.xyz
rrexec.net
linetl.top
freedomcleaningusa.com
abofahad3478.tokyo
teamvalvolineeurope.com
kyty4265.com
afrikannaland.info
dharmatradinguae.com
bqylc.buzz
lifeprojectmanager.pro
streeteli.site
68fk.vip
wasemanntrucking.com
auracreitarusblog.com
dfgzyt.cyou
tecnotuto.net
ookkvip.com
247repairs.info
tyvwotnmrlpjgl.biz
courtneymporter.com
gildainterior.com
papiska.xyz
sparrow.run
tyh-group.com
april-zodiac-sign.info
kiaf1.site
cooleyes.live
partasa.com
connecticutinteriors.com
thelovehandles.us
netinseg.website
diaryranch.xyz
serenaderange.com
milano.icu
vapeseasy.com
hengruncosmetics.com
vlashon.com
masberlian.ink
djayadiwangsa.store
nicneni.xyz
ym2668.top
Targets
-
-
Target
tmp
-
Size
236KB
-
MD5
aabb09c3690d466afdfbbaeb791a8bc8
-
SHA1
128095dc05c3bdc4c00966f6c11ac79117f44833
-
SHA256
44bf46793f182055af9af6112cfd1236073c6ab0c879d0cffb49154e5c1c85dd
-
SHA512
b63268fa65e1346cfb31c0a0e2fc744c7f62a3b49bf287906562b4fb97f7190798132655ad7d2062c203d28d366cf5f273624b7abeb4446e150aae1f30dcdb65
-
SSDEEP
6144:FkwvQpUiezSv/iMQYDfyZepKpDLd8vG3be2x:EpReuiojyZTLd8Grfx
-
Formbook payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-