General
- Target g5f91.exe
- Size 430KB
- Sample201001-jdy7wp2bas
- SHA256 0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d
- MD5 c85b80c8a60460b16bcba9ede71fe5ff
- SHA1 bc74be7970866feb94edb76a5dd62dff7722a165
- SHA512 7b18f124a9e77c5078d9dc904350ae32f7bfb8eb1eca465a508fb7adc0293dc8babb6bd84b13180b2d34e20459ce60159b7d07b9ddb5c43f44f78c5149eb55b6
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
g5f91.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.elevatedqueensnc.com/ajr/
-
cokefork.com
-
sunsabe.com
-
tactical-milsim.com
-
johnporcaro.com
-
quantqubit.com
-
ehrbar2012.com
-
dailymoringpages.com
-
masteronlineteams.com
-
signocomunicaciones.com
-
entrepreneur-de-demain.com
-
eve-echoes-data.com
-
readingbythewindow.com
-
quoteshark.net
-
mundoeconomic.com
-
bootlegmask.com
-
sporkedmissoula.com
-
claricitywealthplanning.net
-
lyotrade.net
-
brandtokitchens.com
-
blackstorymedia.com
-
armstrongramps.com
-
shinelinks.net
-
xhubstory.xyz
-
dannisconfessions.com
-
mycology.supplies
-
virtualinspectiontraining.com
-
usarmedforcesforbiden.com
-
theduneco.net
-
govirtualgym.com
-
pricemanmmi.com
-
eleanorandhick.com
-
grosgay.com
-
artmasteronline.com
-
psm-gen.com
-
strikermanagementgroup.com
-
tdhudsonfarms.com
-
nefkin.net
-
firewoodlogsbristol.com
-
csbaoxing.com
-
firestarterelectronics.com
-
igreels.today
-
janet-lorenz.com
-
bookyachting.com
-
kayarihats.com
-
wd7369.com
-
kvhchocen.com
-
madfishrods.com
-
yourprotectionguide.com
-
piao.mobi
-
loveinspiredtees.com
-
cric4c.com
-
tapchiotoxemay.net
-
engelhartweb.com
-
cgv-so.com
-
easyloop.email
-
xn--sss-ula.com
-
anunaysrivastava.com
-
1padrepio.com
-
getuewbessedre.com
-
achrafbarrou.com
-
misspinkk.com
-
717cary.com
-
myworldgay.com
-
alfcsg.com
Targets
-
- Target g5f91.exe
- Size 430KB
- SHA256 0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d
- MD5 c85b80c8a60460b16bcba9ede71fe5ff
- SHA1 bc74be7970866feb94edb76a5dd62dff7722a165
- SHA512 7b18f124a9e77c5078d9dc904350ae32f7bfb8eb1eca465a508fb7adc0293dc8babb6bd84b13180b2d34e20459ce60159b7d07b9ddb5c43f44f78c5149eb55b6
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext