General
- Target Editing Remittance copy.exe
- Size 570KB
- Sample201016-2xwxcjchrn
- SHA256 77e828d113038623ccfca7e111b60675fd36ea404545f8ce828d7f8505244f0d
- MD5 fe348898b6d84d43a80dfbc48d94c63d
- SHA1 0d4e6ca64ef3b7978ef7361ffa72bf58911b8f62
- SHA512 24ae1ba01ec0d0c918fdcfbadb6496ce00513fb8cd88a864f6872bbed9c1bbdabc56d28c516c20fcea50651af49c0b75259bb83603b547e26886fa2461775af9
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Editing Remittance copy.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.jsbdistributor.com/u2e/
-
aartihand.com
-
texasreloaded.com
-
2794moraga.com
-
mybcinfo.com
-
wriz.xyz
-
headlundco.com
-
officialangelanichelle.com
-
danielledelaine.com
-
ateliermalibu.com
-
vantaimanhtruong.com
-
zhimazhiyun.com
-
saimeeraservices.com
-
baisongke.com
-
catearhelmet.com
-
palasian.net
-
merchantofzanzibar.com
-
ateliercrepin.com
-
guardtactics.com
-
ceritadata.com
-
nacesiti.com
-
pinacle.online
-
sosgov.com
-
batchjoy.com
-
arosevirtualassistant.com
-
xn--razfashion-l8a.com
-
worstcasebestcase.com
-
lemengkj.com
-
rekill.space
-
kumpanews.com
-
6936399.com
-
theselfunknown.com
-
jenniferlwilsonrn.com
-
thefeesimple.com
-
my500now1.club
-
goflexcolors.com
-
moneysavingexpertmonarch.xyz
-
notaria8colima.com
-
mtourlo.com
-
pomp.coffee
-
colettesimonepsyd.com
-
videocoachforbusiness.com
-
samograd.online
-
sustainableminimalistyoga.com
-
charactermovement.net
-
ahyqmux.icu
-
severbroke.com
-
impresos25.com
-
detroitswingcompany.com
-
onehealthtaskforce.com
-
adesignmuseum.net
-
roguesummers.net
-
stephaniebauer.net
-
kommodore.online
-
daveadonai.com
-
a-great-homegym.fyi
-
duwegawe.com
-
bukannyaterbuai34.com
-
murphyconstructiongunnison.com
-
peacelovez.com
-
saleselgaucho.com
-
ahrmj.com
-
quickprepandship.com
-
t4pacademy.com
-
themarketingrecipes.com
Targets
-
- Target Editing Remittance copy.exe
- Size 570KB
- SHA256 77e828d113038623ccfca7e111b60675fd36ea404545f8ce828d7f8505244f0d
- MD5 fe348898b6d84d43a80dfbc48d94c63d
- SHA1 0d4e6ca64ef3b7978ef7361ffa72bf58911b8f62
- SHA512 24ae1ba01ec0d0c918fdcfbadb6496ce00513fb8cd88a864f6872bbed9c1bbdabc56d28c516c20fcea50651af49c0b75259bb83603b547e26886fa2461775af9
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext