General
- Target SKM120945.exe
- Size 436KB
- Sample201015-9rc47zhb3j
- SHA256 e85ece3cee51156974c3fb8f0e2c707dae2b51b0d2db9e5fb10531d2fdd76ca6
- MD5 613b4067cc629cef0c2deed1599df990
- SHA1 f24732881828c3860996113217a5ea4d0f16a8bc
- SHA512 41ab6203e181d7d8568dbff4165b80651d3f8ac3277489535935a9bca8b61aeb45e10076336ce766b45c5a815a8f186f8775d3b665a6b4c95578fea914d21252
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
SKM120945.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.ruartemoyano.com/xnc/
-
haitchworks.com
-
36rn.com
-
cc-js.com
-
godscult.com
-
partypooperlv.com
-
norcalsolarcleaning.com
-
vedatdmr.com
-
bbvau.com
-
abranna.com
-
pools.win
-
baltimoresoftware.com
-
sdafund.com
-
marketinglocal.digital
-
edyta-bober.com
-
uyorku.com
-
boudoirphotographerdallas.com
-
sunshineandcoffeeboutique.com
-
batttleroyaleuk.com
-
11382.xyz
-
euphoricjewelzz.com
-
wokegazette.com
-
xn--tlqy2kwukdnhqra768v.com
-
phybby.com
-
citestaccnt1598622257.com
-
consultation-hippopotame.com
-
audacyti.com
-
behaviourbydesign.com
-
gangstaapparel.com
-
uydu-elektrik.com
-
neurofitdrink.com
-
thebestcoffeeshops.com
-
208mountainadventures.com
-
domennyarendi65.net
-
studio-alfarasha.com
-
cosswizz.com
-
lassira.com
-
followmyubmdhealth.com
-
aowthaibirdnest.com
-
ultimatesimulation.com
-
visacoincard.com
-
hometohome-club.com
-
n0cdgh.com
-
alphanajankal.com
-
ralphlaurenfabrics.com
-
tarakilby.com
-
besttipsshop.com
-
wikigfx.com
-
soundhoney.net
-
astoryexperience.com
-
angelsolers.com
-
ragdollmafia.com
-
katakansetsu.com
-
embedded4all.com
-
xnyov.com
-
sellfyou.com
-
lgmasks.com
-
wggrp.com
-
colorblinddesigner.com
-
makefud.com
-
dbcm55.com
-
7d646n.com
-
magentnew.com
-
wilsoncamargoycia.com
-
seawisechartering.com
Targets
-
- Target SKM120945.exe
- Size 436KB
- SHA256 e85ece3cee51156974c3fb8f0e2c707dae2b51b0d2db9e5fb10531d2fdd76ca6
- MD5 613b4067cc629cef0c2deed1599df990
- SHA1 f24732881828c3860996113217a5ea4d0f16a8bc
- SHA512 41ab6203e181d7d8568dbff4165b80651d3f8ac3277489535935a9bca8b61aeb45e10076336ce766b45c5a815a8f186f8775d3b665a6b4c95578fea914d21252
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext