General
- Target Swift Copy.exe
- Size 490KB
- Sample201014-q2vpaeflke
- SHA256 8ce26cc2fb22fe3d89d7f4bd9ea925f0719ff9208b4e37b1f71b9d4e810bcc0c
- MD5 c7940438819a62c9dd82d206ca4db81f
- SHA1 86100dc4042fad3609e8eff175e1409f1b899eb2
- SHA512 5d5774311cb62deb5035204818d0c4559bfc76daa487d32f5846a2b42e3ccb3690608a37c44fdf3b33994d870433e7fac9ce88ed22fbad5667564df31a230369
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.purebodyrecovery.com/rhk/
-
decodemethod.com
-
mamakeyfim.xyz
-
3smokers.com
-
rentaspendirect.com
-
projectstasksjobs.com
-
animedesignetees.com
-
ursthegardennurse.com
-
sunandmoonshirts.com
-
encuentros-es.com
-
nevadahomebirth.com
-
xoxoplants.com
-
tentenos.com
-
anhpham.net
-
beyondtourney.com
-
surfficient.com
-
wannahavedays.online
-
hmyhvgxax.icu
-
holisticskincarecompany.com
-
juggfuckers.com
-
ixgrmz.com
-
chant4yourlife.com
-
clgfzqgw.com
-
pandemiclearningpodsfairfax.com
-
pagmorlormun.com
-
m4ufred.com
-
xn--yaaou-zra.com
-
kai-tan.com
-
letstalkmamahk.com
-
nettbasertutdanning.com
-
phantheon.com
-
sweet-elite.com
-
eyepointph.com
-
hand-madebyrae.com
-
mexikanno.com
-
dunkerque-dentiste.com
-
novusingeniumgroup.com
-
fadin.xyz
-
azmro.com
-
vistaar.world
-
sobrietees.net
-
landschaftstechnik.com
-
roofingguidesite.com
-
betboo507.com
-
fromcelltosell.com
-
amianinfluencer.com
-
grayboxus.com
-
lamnhistudio.com
-
chyjzs.com
-
zhinengjiashiche.com
-
pchcmgrant.com
-
jnyijia.com
-
elementx.agency
-
izhangdong.com
-
topsit.website
-
travelswithsonny.com
-
traceqeisiholdings.com
-
audio-tron.com
-
moonstarinfinity.com
-
dream11exch9.com
-
pocketfieldtrip.com
-
mdsport-eg.com
-
southshoreagles.com
-
275353074.com
-
kgmba.net
Targets
-
- Target Swift Copy.exe
- Size 490KB
- SHA256 8ce26cc2fb22fe3d89d7f4bd9ea925f0719ff9208b4e37b1f71b9d4e810bcc0c
- MD5 c7940438819a62c9dd82d206ca4db81f
- SHA1 86100dc4042fad3609e8eff175e1409f1b899eb2
- SHA512 5d5774311cb62deb5035204818d0c4559bfc76daa487d32f5846a2b42e3ccb3690608a37c44fdf3b33994d870433e7fac9ce88ed22fbad5667564df31a230369
- MD5 SHA1 SHA512
-
Formbook Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext