General
- Target L3fLdu8DyoA55xo.exe
- Size 671KB
- Sample201027-5neeebbk2e
- SHA256 77707d4b60a7193c8c7e93d9c97dcd89513ef4ce1c8e19aa6780920c09e03c27
- MD5 ad45827e71cf3ef5efe845f70374b35f
- SHA1 fe187d0994e5c03f2b8b93595929f1cd0d166c15
- SHA512 366373b53f827d69c418d85f7c19fdb238596b46149e91ddb7685487b8b203e647b56cd2398c391fe57ef558bfef37485887dc559bec6ddcdc2285003f71df77
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
L3fLdu8DyoA55xo.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.trusted-inspections.com/k8b/
-
lulubellsgraphicsanddesigns.com
-
metyx.info
-
www423337.com
-
stayliveclothing.com
-
daluotech.com
-
thetruthpublished.com
-
pqlzlnwpz.icu
-
bilginhayvancilik.com
-
ismartdvr.com
-
currenibtc.com
-
dalesj.com
-
restaurantlemontblanc.com
-
lunarstores.com
-
pho-huy.com
-
liquidhardrive.com
-
bcheaplivebuy.com
-
evisaagency.com
-
houstonemergencycenter.com
-
alioverstreet.com
-
nutrhyp.com
-
fzwsnrbzw.icu
-
shesoo.com
-
xn--meditaoevida-7bb9c.com
-
hayatveren-world.com
-
thegamergang.com
-
dayforum.com
-
teamhoodied.com
-
weightm-llc.com
-
synertry.net
-
mariaclarahairstudio.com
-
smartnomic.com
-
seaecstasy.com
-
bestourway.com
-
liferiskmanager.com
-
myeducationnoodle.com
-
cooklikeaspanish.com
-
apacheboatsstory.com
-
688009.xyz
-
even-hand.com
-
therussellpinto.com
-
browedandbare.com
-
hblajiche.com
-
bodygoalsspa.com
-
adeedyworld.com
-
daddydomsme.com
-
webioff.com
-
respec-d.com
-
bitches4studs.com
-
shorasmedan.com
-
mjzmusicphotography.com
-
govild.com
-
luckyfoodexpress.com
-
camouflagedbeauty.com
-
contaclessfundraising.com
-
sencmil.info
-
highwaistedskirts.com
-
alanppafcommodities.com
-
findingthefaceofgod.com
-
peiqizn.com
-
fallgays-mobile.com
-
goudengoed.com
-
shisang.xyz
-
akenco-pharma.com
-
fishingtournament.website
Targets
-
- Target L3fLdu8DyoA55xo.exe
- Size 671KB
- SHA256 77707d4b60a7193c8c7e93d9c97dcd89513ef4ce1c8e19aa6780920c09e03c27
- MD5 ad45827e71cf3ef5efe845f70374b35f
- SHA1 fe187d0994e5c03f2b8b93595929f1cd0d166c15
- SHA512 366373b53f827d69c418d85f7c19fdb238596b46149e91ddb7685487b8b203e647b56cd2398c391fe57ef558bfef37485887dc559bec6ddcdc2285003f71df77
- MD5 SHA1 SHA512
-
Formbook Payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext