General
- Target SWIFT TRANSFER.exe
- Size 490KB
- Sample201006-2kfym1f1qn
- SHA256 ec4ee2fa916e9fc280f06af0ceded7835693723ebbc6c60bd6e371b5d4ad006a
- MD5 b66ea2403a923c0105ad0559e9f6e53b
- SHA1 c4864e857f383ad6535009a04f5e3b4a7d74e1dc
- SHA512 6938636c4d34c56d33ceba2d0091e79fdf60dc09541a9d535b4117936d4b100ebd01ea0f31aab39e1a289259ffb5954acf54b6b78129a0eef881c2e683b0fc6b
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT TRANSFER.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.purebodyrecovery.com/rhk/
-
decodemethod.com
-
mamakeyfim.xyz
-
3smokers.com
-
rentaspendirect.com
-
projectstasksjobs.com
-
animedesignetees.com
-
ursthegardennurse.com
-
sunandmoonshirts.com
-
encuentros-es.com
-
nevadahomebirth.com
-
xoxoplants.com
-
tentenos.com
-
anhpham.net
-
beyondtourney.com
-
surfficient.com
-
wannahavedays.online
-
hmyhvgxax.icu
-
holisticskincarecompany.com
-
juggfuckers.com
-
ixgrmz.com
-
chant4yourlife.com
-
clgfzqgw.com
-
pandemiclearningpodsfairfax.com
-
pagmorlormun.com
-
m4ufred.com
-
xn--yaaou-zra.com
-
kai-tan.com
-
letstalkmamahk.com
-
nettbasertutdanning.com
-
phantheon.com
-
sweet-elite.com
-
eyepointph.com
-
hand-madebyrae.com
-
mexikanno.com
-
dunkerque-dentiste.com
-
novusingeniumgroup.com
-
fadin.xyz
-
azmro.com
-
vistaar.world
-
sobrietees.net
-
landschaftstechnik.com
-
roofingguidesite.com
-
betboo507.com
-
fromcelltosell.com
-
amianinfluencer.com
-
grayboxus.com
-
lamnhistudio.com
-
chyjzs.com
-
zhinengjiashiche.com
-
pchcmgrant.com
-
jnyijia.com
-
elementx.agency
-
izhangdong.com
-
topsit.website
-
travelswithsonny.com
-
traceqeisiholdings.com
-
audio-tron.com
-
moonstarinfinity.com
-
dream11exch9.com
-
pocketfieldtrip.com
-
mdsport-eg.com
-
southshoreagles.com
-
275353074.com
-
kgmba.net
Targets
-
- Target SWIFT TRANSFER.exe
- Size 490KB
- SHA256 ec4ee2fa916e9fc280f06af0ceded7835693723ebbc6c60bd6e371b5d4ad006a
- MD5 b66ea2403a923c0105ad0559e9f6e53b
- SHA1 c4864e857f383ad6535009a04f5e3b4a7d74e1dc
- SHA512 6938636c4d34c56d33ceba2d0091e79fdf60dc09541a9d535b4117936d4b100ebd01ea0f31aab39e1a289259ffb5954acf54b6b78129a0eef881c2e683b0fc6b
- MD5 SHA1 SHA512
-
Formbook Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext