General
- Target YP20210925.exe
- Size 441KB
- Sample211019-kvg6qsfea2
- SHA256 f358d592a02990a899bc4ca7c35804529237cbffac5dcabb3e7e3916a79afbb4
- MD5 caf066c4b6bf7905dfb085c281cffd49
- SHA1 ea024a8c24ec21e799ae1c210a2a01d14ad7ecc8
- SHA512 b60bb2920ce26e4b954b271764465ac50fefd53b4a806f8629c7894874649b2c540219f4be1b39dc56bf8395820df981ac64f6b4853c3c469fa28d9729034bec
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
YP20210925.exe
Resource
win7-en-20211014
Malware Config
Extracted
-
formbook
-
4.1
-
cb2k
-
http://www.freegovphoneservice.com/cb2k/
-
prets-personnels-faciles-1.com
-
lavandica.com
-
855goldenpark.com
-
ebrandschool.com
-
annielaineinspirations.com
-
tuscumbiadivorceattorney.com
-
lovarebanwgt74.xyz
-
car-plus.info
-
fireloops.net
-
psychtechsolutions.com
-
didubreak.com
-
cursodesigndesobrancelhas.com
-
berrymyrick.com
-
visit-croatia-now.com
-
chamonix-cars.club
-
1679tnpnd01uzznpvfu8795.com
-
noisedelayrecovery.com
-
sergiotimoteo.com
-
lplc.cloud
-
ppezjo.com
-
pernam.xyz
-
789463.com
-
triadinjurylawyer.com
-
bergenbibliotek.com
-
justgarageflooring.com
-
cloudmirror.xyz
-
pokilj.xyz
-
lnpost.net
-
deadlyartzjv.xyz
-
videotodayonline.com
-
stefanotocco.com
-
darlinmarket.com
-
bh-cbd.com
-
ovghjm.com
-
jsaben.com
-
retail-shop-art.com
-
safehamstersleague-giveaway.com
-
mejorespatineteselectricos.com
-
allworklancer.com
-
memoriesartforever.com
-
maheshlivera.com
-
newyorktoken.com
-
visions.expert
-
eroticvideos.xyz
-
luma-seminaire.com
-
ejoieshop.com
-
artemissharpe.com
-
yh7442.com
-
miiromance.com
-
heetstanbul.com
-
bumemleketbizim.com
-
w7world.design
-
epixeirisi.xyz
-
thevahid.com
-
popolatec.rest
-
blackband.site
-
unfreeze-seattle.com
-
smartpottery.com
-
harmonyisus.com
-
coworkerspot.com
-
cronanna.com
-
eest3si.com
-
israelnewstoday.com
-
insurance-quote-4-il.com
Targets
-
- Target YP20210925.exe
- Size 441KB
- SHA256 f358d592a02990a899bc4ca7c35804529237cbffac5dcabb3e7e3916a79afbb4
- MD5 caf066c4b6bf7905dfb085c281cffd49
- SHA1 ea024a8c24ec21e799ae1c210a2a01d14ad7ecc8
- SHA512 b60bb2920ce26e4b954b271764465ac50fefd53b4a806f8629c7894874649b2c540219f4be1b39dc56bf8395820df981ac64f6b4853c3c469fa28d9729034bec
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext