General
- Target PO2364#FD212003.exe
- Size 1.0MB
- Sample210118-v7433vs7d6
- SHA256 f03367cb1758bddd8877e7aca02223797330fc8482d6ffce6f397730ffefd53f
- MD5 b7c168ea63b8e1c2fa7eb4059d85283e
- SHA1 a41f448c52e01434275c86b928b8b64222e77734
- SHA512 b4cac0d652270d385014b0ef90159e279b768f1061ae1086e9df4043a838faed4585dc38b08426e76cc4c39d2c5ed7ccf399e28107eb8dd26011efed3a02cb63
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
PO2364#FD212003.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.styrelseforum.com/p95n/
-
kimberlyrutledge.com
-
auctus.agency
-
johnemotions.com
-
guilt-brilliant.com
-
wxshangdian.com
-
theolivetreeonline.com
-
stellarfranchisebrands.com
-
every1no1.com
-
hoangthanhgroup.com
-
psm-gen.com
-
kingdomwow.com
-
digitalksr.com
-
karynpolitoforlg.com
-
youthdaycalgary.com
-
libertyhandymanservicesllc.com
-
breatheohio.com
-
allenleather.com
-
transformafter50.info
-
hnhsylsb.com
-
hmtradebd.com
-
besrhodislandhomes.com
-
zuwozo.com
-
southernhighlandsnails.com
-
kaaxg.com
-
bauer-cobolt.com
-
steelyourselfshop.net
-
linksoflondoncharmscheap.com
-
groundwork-pt.com
-
beautifulangelicskin.com
-
aduhelmfinancialsupport.com
-
xn--carpinteratarifa-hsb.com
-
thekingink.net
-
ocotegrill.com
-
gilbertdodge.com
-
insuranceinquirer.com
-
withagentcy.com
-
deeparchivesvpn.com
-
blamekd.com
-
acsdealta.xyz
-
dsxcj.com
-
kimonoshihan.com
-
bosquefamily.com
-
5587sk.com
-
integrative.life
-
unitedjournal.info
-
lynxdeck.com
-
onlyfanyou.com
-
aminomedicalscience.com
-
rachenstern-technik.com
-
thejewelrybox.net
-
stopcolleges.com
-
thesaltlifestyle.com
-
tappesupportservices.com
-
andrewgreenhomes.com
-
meidiansc.com
-
gobalexporter.com
-
rvpji571m.xyz
-
alwekalaaladabeya.com
-
scientificimaginetics.com
-
skaizenpharma.com
-
balloonpost.club
-
thefunnythingabout.com
-
premium-vitality.com
-
businesscalmcoaching.com
Targets
-
- Target PO2364#FD212003.exe
- Size 1.0MB
- SHA256 f03367cb1758bddd8877e7aca02223797330fc8482d6ffce6f397730ffefd53f
- MD5 b7c168ea63b8e1c2fa7eb4059d85283e
- SHA1 a41f448c52e01434275c86b928b8b64222e77734
- SHA512 b4cac0d652270d385014b0ef90159e279b768f1061ae1086e9df4043a838faed4585dc38b08426e76cc4c39d2c5ed7ccf399e28107eb8dd26011efed3a02cb63
- MD5 SHA1 SHA512
Formbook Payload
Deletes itself
Suspicious use of SetThreadContext