General
- Target SecuriteInfo.com.Trojan.PackedNET.509.28611.29307
- Size 1.2MB
- Sample210119-cdc4f8rm52
- SHA256 16160e8686be9eefc11ffc8eafdabfbcda53784d95d1b747717cbb90acaa04d4
- MD5 23a53bec3e0bf43ec47af722a6aac7cb
- SHA1 fca6e1d1690dea3911407662d8979c7cf037d754
- SHA512 b21fdb1c78ddab75df07fb2bbc84f4d3c2061178e6370bcef6744019e1ea5c46152ce7aeb0cfa152ea8c730e53cdca23e27d97fd5e1fdad89c24483f68bcebf1
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.509.28611.29307.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.vitajwb.com/irux/
-
heteltht.com
-
transbordaquemultiplica.com
-
ispartakulecleaner.com
-
woodcutter.website
-
gy88api8888.com
-
forsagemagic.com
-
greenqobbler.com
-
piligame.com
-
pcbet333.com
-
superpuzzlegames.com
-
jameslearyrealestate.com
-
acmarketinghacks.com
-
world-travel.xyz
-
sprayfoampocatello.com
-
anshangbao.com
-
qacpilotacademy.com
-
aodaicali.com
-
aarusystems.com
-
potion-designs.com
-
bajaenvocho.com
-
ourwfh.com
-
upliftfurnitureconcepts.com
-
almurasilnews.com
-
thestillmancowboyhats.com
-
blessedparfum.com
-
brandceowd.com
-
dekenchar.com
-
leaseplein.com
-
riverandrailga.com
-
smartbandbtraders.com
-
www-instagramhelpcenter.com
-
maneinstinct.com
-
jennifer-jones.com
-
exonmobilerewardsplua.com
-
westgateoptometry.net
-
cornelldevelopment.com
-
grhkj.com
-
authenicblackculture.com
-
feriavirtualdelibros.com
-
mountresonant.life
-
shopcelebratory.com
-
juliaaiz.art
-
fiveminutefixers.net
-
limonseltzer.com
-
skinsworldtrade.com
-
xn--vhqqb70qmrhwmvnh0e.xyz
-
rangers3.xyz
-
meixia.space
-
xn----7sbncclroqxy.xn--p1acf
-
cindybakerdesigns.com
-
ccheapvrshop.com
-
ymoac.com
-
well-being.international
-
ymdycrea.net
-
bowlboo.com
-
marikajboutique.com
-
ckhomecare.com
-
meimingvip.com
-
dwicans-8.info
-
downtoearthdiner.com
-
nantoeas.club
-
mugephoto.com
-
bestey.com
-
opinnovatesmx.com
Targets
-
- Target SecuriteInfo.com.Trojan.PackedNET.509.28611.29307
- Size 1.2MB
- SHA256 16160e8686be9eefc11ffc8eafdabfbcda53784d95d1b747717cbb90acaa04d4
- MD5 23a53bec3e0bf43ec47af722a6aac7cb
- SHA1 fca6e1d1690dea3911407662d8979c7cf037d754
- SHA512 b21fdb1c78ddab75df07fb2bbc84f4d3c2061178e6370bcef6744019e1ea5c46152ce7aeb0cfa152ea8c730e53cdca23e27d97fd5e1fdad89c24483f68bcebf1
- MD5 SHA1 SHA512
-
Formbook Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext