General
- Target Additional Agreement 2020-KYC.exe
- Size 558KB
- Sample201106-trs8wmxdln
- SHA256 dc647305de0ae67eff2e86276355bc83aa761b03693459df14d10ae6cd4a3102
- MD5 37c2650f0af20d95c57be00227ad342f
- SHA1 c38e315f0bd4106e19811f0224306d957258a981
- SHA512 e5f7f917e792d8efbf1f6f83fae46cf6ac7aa3c870b44bf209d41426d2b8f3f36192f56a1ec4fe9a4f028c8e5b3aae9dd0da90127f8432ccd09b4419bc5a64c1
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Additional Agreement 2020-KYC.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.csgo-c4ses.com/bw82/
-
orchid-iris.com
-
owner.codes
-
crispcleanbodyrituals.com
-
nocreditcarswestpalm.com
-
sweetsasu.com
-
downlooader.com
-
candleish.com
-
43414newportdr.com
-
78kanshu.net
-
tncnn.com
-
bcheaptvwd.com
-
trephone.art
-
aloharecords.com
-
latinaexpres.com
-
comminterbusiness.com
-
evokingcalm.com
-
mckarthylabscoe.com
-
make-trends.com
-
modernhomeskitchen.com
-
mousybusiness.com
-
dentonparalegals.com
-
dreammakeloja.com
-
caffeinatedmamasblog.com
-
stockandbarrell.com
-
tesla-commercio.com
-
friendsofhersheypa.com
-
sajjaddeveloper.com
-
roechling-roding.run
-
ruffstuffstore.com
-
monnetier-mornex.com
-
aplustd.com
-
hjscinc.com
-
riquimbilis.com
-
free-outlet.com
-
mail-businessprinting.com
-
xzaztlrl.icu
-
artofsapna.com
-
mercyvh.com
-
beauskitchen.com
-
amq-studio.com
-
whentime12.com
-
helptechservices.com
-
erraticer.com
-
nationalreturnday.com
-
justincook.xyz
-
shopjrock.com
-
breakfastcandy.net
-
penislandbrews.com
-
fjweiwang.com
-
mosterth.com
-
xn--gdask-y7a.com
-
packorganically.com
-
greaterdiabetes.info
-
neotactic.net
-
tiedcaps.rest
-
prandartsagency.com
-
tdmmk.site
-
octoberx2.online
-
idealgaysex.com
-
devitasaude.com
-
tatsunoichie.com
-
amazonprim8.art
-
mcwildwest.net
-
sewythingy.com
Targets
-
- Target Additional Agreement 2020-KYC.exe
- Size 558KB
- SHA256 dc647305de0ae67eff2e86276355bc83aa761b03693459df14d10ae6cd4a3102
- MD5 37c2650f0af20d95c57be00227ad342f
- SHA1 c38e315f0bd4106e19811f0224306d957258a981
- SHA512 e5f7f917e792d8efbf1f6f83fae46cf6ac7aa3c870b44bf209d41426d2b8f3f36192f56a1ec4fe9a4f028c8e5b3aae9dd0da90127f8432ccd09b4419bc5a64c1
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext