General
- Target Noua comanda atasata.exe
- Size 684KB
- Sample210920-g3rtcsdbc7
- SHA256 d21cbbc50e85c872732a119f1c0d567a54cd6a75c512c3bf84baba8a8fbfc97d
- MD5 c611faa69a1070e52f53defe4d67e8ee
- SHA1 21fcf75a374ea7764100b46505085246746a7616
- SHA512 f8f02c153f96d8cd6711be28bcbbb38acb156f14f4ddb697cc0f1a1a1f9f882bbd8111a44540a7d6c34f3bcff606cf3afea64a7ba4944c2200ba5db2fe703aa4
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Noua comanda atasata.exe
Resource
win7-en-20210916
Malware Config
Extracted
-
formbook
-
4.1
-
bc3s
-
http://www.topei-products.com/bc3s/
-
anna-ng.com
-
mariangelamata.com
-
szqnbl.com
-
nesherguitars.com
-
mysekrit.com
-
againbeautyviensui.xyz
-
appf.life
-
bilalsolution.com
-
technoratii.com
-
11restoran.com
-
birthingly.com
-
crystalcarrillo.com
-
cohenasset.info
-
bunchofdesign.com
-
highstreetmag.com
-
talentkerning.com
-
outdoor-glassesadvice.com
-
aliceeety.com
-
habbuhot.info
-
pao91.com
-
resgatarpontosparavoce.com
-
tuancai.net
-
cnynckcrw.com
-
visaza.com
-
paulettecallen.com
-
kandmfinancialgroup.com
-
malibuclassix.com
-
thespoonteller.com
-
vidyaxyp.com
-
xn--gmsepetim-q9ab20j.com
-
saudesexualdoshomens.com
-
safehandmarketing.com
-
yebimhieu.site
-
alimitchellmedia.com
-
andrewpatrickpiette.com
-
astro-paradise.com
-
domainechoquet.com
-
navihealthpartners.com
-
detroitveganseafood.com
-
spankingandpunishment.com
-
magalu-queromais.com
-
mallsinup.com
-
rmsnidlogini.cloud
-
lifeisveryessential.com
-
stolzfus.com
-
iniciala.com
-
designslayers.com
-
clinivahq.com
-
ubersms.com
-
welenb.com
-
skyegroupllc.com
-
happyburger.net
-
moredate-s.com
-
alon-mail.com
-
voceprofessor.com
-
dokadveri.com
-
lafabricadisseny.com
-
westwooddesign.net
-
blossoms-boutique.com
-
jumtix.xyz
-
dietgulfport.com
-
soccerstreamer.com
-
lapurtcedd.com
-
secret-mall.com
Targets
-
- Target Noua comanda atasata.exe
- Size 684KB
- SHA256 d21cbbc50e85c872732a119f1c0d567a54cd6a75c512c3bf84baba8a8fbfc97d
- MD5 c611faa69a1070e52f53defe4d67e8ee
- SHA1 21fcf75a374ea7764100b46505085246746a7616
- SHA512 f8f02c153f96d8cd6711be28bcbbb38acb156f14f4ddb697cc0f1a1a1f9f882bbd8111a44540a7d6c34f3bcff606cf3afea64a7ba4944c2200ba5db2fe703aa4
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext