General
- Target order.exe
- Size 239KB
- Sample210108-e4v67w9s9e
- SHA256 6b44ff9b8963adb4cd20ea744317da9774bc1bb90f2c9692419ee28d38740826
- MD5 0cdef98f5ed0ab013820bf4d87fa337a
- SHA1 ab724aee2548377cd06bf76464b81762bdcffafb
- SHA512 cf29c70511432682eacec77019e3f71c38f409be4819dcf3c00dab9c7a2f681bc2c94e1d0a55f931c00a7d90e84a6caa93e69e447ee7f43f62983d03a9f5cd0d
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
order.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.nationshiphop.com/hko6/
-
apartmentsineverettwa.com
-
forritcu.net
-
hotroodes.com
-
skinnerttc.com
-
royaltrustmyanmar.com
-
adreslog.com
-
kaysbridalboutiques.com
-
multitask-improvements.com
-
geniiforum.com
-
smarthomehatinh.asia
-
banglikeaboss.com
-
javlover.club
-
affiliateclubindia.com
-
mycapecoralhomevalue.com
-
comparamuebles.online
-
newrochellenissan.com
-
nairobi-paris.com
-
fwk.xyz
-
downdepot.com
-
nextgenmemorabilia.com
-
achonabu.com
-
stevebana.xyz
-
jacmkt.com
-
weownthenight187.com
-
divshop.pro
-
wewearceylon.com
-
skyreadymix.net
-
jaffacorner.com
-
bakerlibra.icu
-
femalecoliving.com
-
best20banks.com
-
millcityloam.com
-
signature-office.com
-
qlifepharmacy.com
-
dextermind.net
-
fittcycleacademy.com
-
davidoff.sucks
-
1033393.com
-
tutorsboulder.com
-
bonicc.com
-
goodberryjuice.com
-
zhaowulu.com
-
teryaq.media
-
a-zsolutionsllc.com
-
bitcoincandy.xyz
-
cfmfair.com
-
annefontain.com
-
princesssexyluxwear.com
-
prodigybrushes.com
-
zzhqp.com
-
hwcailing.com
-
translatiions.com
-
azery.site
-
wy1917.com
-
ringohouse.info
-
chartershome.com
-
thongtinhay.net
-
2201virginiacondo5.com
-
laurieryork.net
-
mujeresnegociantes.com
-
anchoriaswimwear.com
-
michaelsala.com
-
esdeportebici.com
-
ninjitsoo.com
Targets
-
- Target order.exe
- Size 239KB
- SHA256 6b44ff9b8963adb4cd20ea744317da9774bc1bb90f2c9692419ee28d38740826
- MD5 0cdef98f5ed0ab013820bf4d87fa337a
- SHA1 ab724aee2548377cd06bf76464b81762bdcffafb
- SHA512 cf29c70511432682eacec77019e3f71c38f409be4819dcf3c00dab9c7a2f681bc2c94e1d0a55f931c00a7d90e84a6caa93e69e447ee7f43f62983d03a9f5cd0d
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext