General
- Target HMT-200810-02.exe
- Size 713KB
- Sample201105-g2yd1mgh7a
- SHA256 e3114262b2bf20de2c2b95534ba7c5ce497f894a3ecd99005f698a853c7f3b3e
- MD5 370ac1df258968d1d39b432d32d3af3e
- SHA1 aba97b6f3b746fc40ea91945430079e81a9609f0
- SHA512 d752a327aadae92f6034acde6d733a16ca5a5af8d39220b8e6644fb011c1f059161a5ff84ec022867e444c937f45a3990886c1eb8c21f87f35574e56607c543c
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
HMT-200810-02.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.unpreneurmania.com/ve9i/
-
crystallynnhealthcoach.com
-
leggingclubs.com
-
artpeixun.com
-
sanguineeses.com
-
865kcd.com
-
pacificwayexpress.com
-
unioncountyneighbors.com
-
taohuayuji.com
-
kerempe.com
-
worldclassgem.com
-
berakahholdings.com
-
rechardpeelphotography.com
-
rasgobenadache.com
-
kyg.global
-
innovation-innovation.com
-
tipsforstudying.com
-
albert.fitness
-
familycontractingwi.com
-
covid19overwatch.com
-
arcfleur.com
-
disalum.com
-
magentnew.com
-
townsvillecbdstorage.site
-
teamsonas.com
-
lkfsmkfspk.net
-
evmates.com
-
conectarargentina.com
-
beautystyle.today
-
sillywalktools.com
-
persaingantaxivsgrab.com
-
hxrxbj.com
-
missluxeboutique.com
-
pasigraphie-joinder.com
-
allwebake.co.uk
-
trusted-seo.agency
-
weareprof.com
-
babymize.com
-
brehmer-bau.com
-
inreachpt.com
-
devcomunicacao.com
-
v-o-o.com
-
qoslkkhqtg.net
-
puertovallartagirls.com
-
xn--lespublicits-leb.com
-
mozackwholesale.com
-
biastreats.com
-
onlyfanssarah.com
-
outliercasestudies.com
-
pridedego.com
-
serviciossg.com
-
themanly.club
-
xgzx111.net
-
mgainversiones.com
-
youhuigouw.com
-
mindthegapsound.com
-
loveshayari.info
-
mxlmic.com
-
lanikorera.com
-
953windsor.com
-
luxenoircandleco.com
-
whitepastel.net
-
artkdanse25.com
-
startinglinemiracles.com
-
professortkh.com
Targets
-
- Target HMT-200810-02.exe
- Size 713KB
- SHA256 e3114262b2bf20de2c2b95534ba7c5ce497f894a3ecd99005f698a853c7f3b3e
- MD5 370ac1df258968d1d39b432d32d3af3e
- SHA1 aba97b6f3b746fc40ea91945430079e81a9609f0
- SHA512 d752a327aadae92f6034acde6d733a16ca5a5af8d39220b8e6644fb011c1f059161a5ff84ec022867e444c937f45a3990886c1eb8c21f87f35574e56607c543c
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext