General
- Target TT copy.exe
- Size 869KB
- Sample201023-zh2v8asrm2
- SHA256 8c288fd70a35727c16e668d49e1e28964d36a67804e09be663bca9a9ceaeacb4
- MD5 957f36fdc73e2f696761e49bf541fc45
- SHA1 ae495a1e8a73782bf230e13c236f29f8014ead89
- SHA512 4c1246dc2920fc0e9887617fc7da5289d27592889dd70fecc6fd5597e76d1b8a3c3ffbff83964754fe16aa35ea78bbe990e8bc9504e94533c4d36f42d51cd838
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
TT copy.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.richardgraycabinetmaker.com/cmd/
-
marksmanrealestate.com
-
weeiter.com
-
dimody.com
-
tufftech.pro
-
romber.info
-
2theothercurb.com
-
maskibeauty.com
-
kreativedough.com
-
adanacatering.com
-
wordzninja.com
-
testxyy.xyz
-
lifeafterbobby.com
-
sunsageherbs.com
-
dentoncountyattorneys.media
-
18176732933.com
-
fjhgllnrz.icu
-
cryptobankcustody.com
-
theinternetproducer.com
-
motinik.com
-
getcatickets.com
-
sarahkim.world
-
linhengdz.com
-
breadpdq.com
-
kocaelikiralikvinc.com
-
thecoldspoon.com
-
traumaremedies.com
-
sedekahbungkus.net
-
thegioidenlichthao.com
-
bigmoneyempire.com
-
cannwisdom.com
-
helpfromtheweb.com
-
xn--9iq23jv19bduo.net
-
goldmedalzoo.net
-
monkeyonmyback.club
-
wandabooks.com
-
karmasrebels.com
-
tonainy.com
-
passiveincomefact.com
-
mariachitierramiatoluca.com
-
growthdefi.com
-
sidotapnu.com
-
hi-techgps.net
-
aquafiannce.com
-
edscoronashield.com
-
kanto-kouju.com
-
venturecapitalistssummit.com
-
afterfivekids.com
-
appsafety.info
-
halawatfoods.com
-
thehtcc.net
-
atmebenessere.com
-
espritdejuriste.com
-
scholartsac.com
-
realtimeclass.com
-
tabupolitico.net
-
rosalinajonathan.com
-
rabo-aanvraag.space
-
commercialcleaningservices.pro
-
free-virtual-sex18.online
-
imagistor.com
-
fishermanimports.com
-
yesilcamhatiralari.com
-
outdoormedics.com
-
powertransnl.com
Targets
-
- Target TT copy.exe
- Size 869KB
- SHA256 8c288fd70a35727c16e668d49e1e28964d36a67804e09be663bca9a9ceaeacb4
- MD5 957f36fdc73e2f696761e49bf541fc45
- SHA1 ae495a1e8a73782bf230e13c236f29f8014ead89
- SHA512 4c1246dc2920fc0e9887617fc7da5289d27592889dd70fecc6fd5597e76d1b8a3c3ffbff83964754fe16aa35ea78bbe990e8bc9504e94533c4d36f42d51cd838
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext