General
- Target Scan copy 24032021_jpeg.exe
- Size 921KB
- Sample210324-ekea49wdn2
- SHA256 b2d26e59b2f971fc8dad4d1e077a62abaa7fa3650f52d55a6b9974e151a5cde4
- MD5 f0a49867673421041ed8c5959ead26b8
- SHA1 d4be3b8b4caa60f2051042fe296b2257d7b15a1f
- SHA512 dfd543f0296dff44ce9d4c78c87c010927f49400ddb2c70f2b0293954e39cf678a167b2352765218765a4b9d15606c055306c7a4e3502c6df1c7552c9e5fa5fc
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Scan copy 24032021_jpeg.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.fessuseyyesseee.com/mdi/
-
ladybirdatl.com
-
welitebuy.com
-
grace-luna.com
-
kazaniansemporium.com
-
bst133.com
-
bestchoicejewelry.com
-
molhub.com
-
safaalgetha.com
-
schoolice.online
-
paybaopro.com
-
whatsherringsize.com
-
72loca.com
-
katjagrobelnik.com
-
qkp.xyz
-
mixermisses.com
-
northbay-midwifery.com
-
trustedbabymall.com
-
buscv.com
-
auykypznm.club
-
apartmentsalpenroyal.net
-
studioterrossa.com
-
dkxmgygla.icu
-
iidiotproof.com
-
mro-pt.com
-
lightmustgoon.com
-
handmadebyaspenhillfarm.com
-
mafiacanada.com
-
mikailoran.com
-
flatfootedhatting.com
-
directunlock24.com
-
vermontfm.com
-
futrchrch.com
-
americonsult.com
-
rapidfloors.club
-
ersimsekmedya.com
-
aisurmanager.com
-
7kesw69mfduxa9.net
-
cbgraham.com
-
adornafacts.com
-
wracolod.website
-
christophercoxonline.com
-
goldendoveproperties.com
-
jomelhubs.online
-
chineseschool.space
-
fotoincasa.com
-
shar99.com
-
windfuryrealty.com
-
landuumtecnologia.com
-
anettesbokboble.com
-
dwagdjdgrbil.mobi
-
virtualipassistant.com
-
animaltuanoi.com
-
appleshopsenegal.com
-
livelifebig.net
-
louiscity.xyz
-
fmoviea.wtf
-
zhongguoxiaofeixia.com
-
olenfex.com
-
complexechateaublanc.com
-
clickprice.site
-
coolsymblo.com
-
casosclinicoscoqun.com
-
wilnicfood.com
-
pwpusher.com
Targets
-
- Target Scan copy 24032021_jpeg.exe
- Size 921KB
- SHA256 b2d26e59b2f971fc8dad4d1e077a62abaa7fa3650f52d55a6b9974e151a5cde4
- MD5 f0a49867673421041ed8c5959ead26b8
- SHA1 d4be3b8b4caa60f2051042fe296b2257d7b15a1f
- SHA512 dfd543f0296dff44ce9d4c78c87c010927f49400ddb2c70f2b0293954e39cf678a167b2352765218765a4b9d15606c055306c7a4e3502c6df1c7552c9e5fa5fc
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext