General
- Target Reliable Supplies.exe
- Size 548KB
- Sample220331-apf2dabef5
- SHA256 dcc2581e7d573e4a33a8e8edfe740f7b74c54fdfe12531ef1c5a8e13abd89e87
- MD5 bcf0e9c65bd8a3e8516ff0182a899914
- SHA1 d5338150b4eb4918345fa24b5beb15ffe06cf6c1
- SHA512 21ea70392c6f0e9e72dc610987c96d6740dec68984c28bc69c80518755950ee74d90962d1c0bde300e41d18e93b4d6af4fa6600f92a38e6a931cc2770bcfff8d
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Reliable Supplies.exe
Resource
win7-20220311-en
Malware Config
Extracted
-
formbook
-
4.1
-
d1n3
-
scrubbinsisters.com
-
kawuldim.com
-
pyttoin.xyz
-
iyraproperties.com
-
miaurora.net
-
cricutonlinesales.store
-
huangsanguai.com
-
chayaelements.store
-
giftexpress15.xyz
-
antiwardrobe.com
-
wiggly.site
-
avrecommendwiki.com
-
galabet472.com
-
invtips.com
-
tvpoy.xyz
-
raidencity.net
-
ripper66.com
-
ipoyce.online
-
xn--h6q362bj4mp5c.com
-
rooplaza.com
-
xfmm9538.com
-
kelaikemc.com
-
athlonebiokinesiology.com
-
thecodealchemist.net
-
jinwanlicai88.com
-
wecome.club
-
zhekou8.net
-
nuoim.com
-
nikahclub.com
-
templerestleisure.com
-
orino.info
-
oa1xs.xyz
-
colormusedesignco.com
-
okparking2013.com
-
reveplac.com
-
59208.xyz
-
gtm-kalisumapa.com
-
rowanmasonry.com
-
your-funds-available.com
-
outletscheapjordans.com
-
melaniewieseler.com
-
hqdtgyl.com
-
forkidofukraine.com
-
lvsebianzhidai.com
-
lonesomevalley.xyz
-
3pxm.xyz
-
boatsrentalcda.com
-
victoroverseas.com
-
xpertlockandsafe.com
-
newgenelectronics.com
-
demopanel.xyz
-
indianfood101.com
-
jogo.tech
-
clemons.tech
-
lowdowntracks.com
-
haotian9981.com
-
carseg.site
-
dasenlin-jiaju.com
-
peaceandlovebhs.com
-
storkbucket.online
-
crowd-news.com
-
qewuy.biz
-
jjshomefurniture.com
-
amongusleaks.com
-
kompanko.com
Targets
-
- Target Reliable Supplies.exe
- Size 548KB
- SHA256 dcc2581e7d573e4a33a8e8edfe740f7b74c54fdfe12531ef1c5a8e13abd89e87
- MD5 bcf0e9c65bd8a3e8516ff0182a899914
- SHA1 d5338150b4eb4918345fa24b5beb15ffe06cf6c1
- SHA512 21ea70392c6f0e9e72dc610987c96d6740dec68984c28bc69c80518755950ee74d90962d1c0bde300e41d18e93b4d6af4fa6600f92a38e6a931cc2770bcfff8d
- MD5 SHA1 SHA512
-
Formbook Payload
-
Blocklisted process makes network request
-
Suspicious use of SetThreadContext