General
- Target Fatura_Um0slpC3IsVAmnv.exe
- Size 594KB
- Sample201005-tm8sneaqdx
- SHA256 00c31ece69362a5cccc665bc1d57b48240d5bf53cbb159cb72b26454849e798e
- MD5 e192091f95cde41724533037eee016f1
- SHA1 3e31af5c3dacf364505ce50c1bc59f14efad372b
- SHA512 ee46f4aa86e0594d9432ba3dc505b6faaddecfd37ae8219b5e69e10971874c0636358fd780580f3aa80a8cf38f645efe47ee96a83f3672fff41a1fbedfb59df6
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Fatura_Um0slpC3IsVAmnv.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.chsepd.com/agwz/
-
organicsifa.com
-
microlivros.com
-
kharestudio.com
-
processautomationsystem.com
-
359192.com
-
user-id06783.com
-
hoopletesonline.com
-
camrashos.com
-
xfgyzzm.icu
-
jjjllcbooking.com
-
ztouh.info
-
mynetlfis.info
-
honeydigi.com
-
claytelier.com
-
hbozoom.com
-
theleftreports.net
-
drmenelaou.com
-
ignoringracism.com
-
querofalardesaude.com
-
smithysminicharters.com
-
leadate.com
-
richjude.com
-
lasdeliciosasmx.com
-
dynamosdills.com
-
balconesdemercurio.com
-
buyiptv24.com
-
suhejia.com
-
harpoonchicken.com
-
kaymille.com
-
mxjingvv.icu
-
trybeagle.com
-
cranstonhill.com
-
sterlingplaceseniorliving.com
-
aserendipityfairytale.com
-
cartmedical.com
-
leggins-store.com
-
paydayloans10doqd.com
-
offerswap.online
-
buymoreofthese.com
-
bigjuicygoal.com
-
yoakemae.blue
-
slothzzz.com
-
fjuewyxhk.icu
-
thetexantech.com
-
liebaosouti.com
-
cphrealtyllc.com
-
viewpano.xyz
-
korean-ad.xyz
-
sarajdavis.com
-
bluehourdecisions.net
-
julienaltieri.com
-
summitcreators.com
-
microporebrush.com
-
cloudshopgr.com
-
replounge.com
-
fit-for-golf.com
-
umbroclub.com
-
grepreps.com
-
esrasuaklier.xyz
-
inacuastreaming.com
-
beastmodemoving.com
-
sunflourdelights.com
-
vaytiennhanhhn.com
-
binaxnowcovid19.com
Targets
-
- Target Fatura_Um0slpC3IsVAmnv.exe
- Size 594KB
- SHA256 00c31ece69362a5cccc665bc1d57b48240d5bf53cbb159cb72b26454849e798e
- MD5 e192091f95cde41724533037eee016f1
- SHA1 3e31af5c3dacf364505ce50c1bc59f14efad372b
- SHA512 ee46f4aa86e0594d9432ba3dc505b6faaddecfd37ae8219b5e69e10971874c0636358fd780580f3aa80a8cf38f645efe47ee96a83f3672fff41a1fbedfb59df6
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext