General
-
Target
Payment - Swift Copy.exe
-
Size
878KB
-
Sample
201126-83p6vypksx
-
MD5
373529da43706b9b230586b501a000fd
-
SHA1
d1a0ad8fe1c1adc9d27b5ceb3d7d27c9512c5495
-
SHA256
49e40687ad1ffb7ba491d92cd38333d3e96c134ba7739dcdd3e8ee2ea1b19506
-
SHA512
f5ba8fbb2409decc4982c5b9d0c7f6b479e8f184af33e99333b23fbfd493888477aa0442bf58290439bda2b2b26fa729aa6e6d0e2fa6ebe8cd23f0f916a4a085
Static task
static1
Behavioral task
behavioral1
Sample
Payment - Swift Copy.exe
Resource
win7v20201028
Malware Config
Extracted
formbook
http://www.danneroll.com/mnc/
yicaiboli.com
litercoconut.icu
virtuallyfriday.com
joshuahumphreyproperty.com
mercedes-dieselclaims.com
rock-leaf.com
sandglasshours.com
pooldeckpatiodriveway.com
forenvid.com
wasserfuhr-gmbh.com
rizosmil.com
alberletgyor.com
besafetexting.com
ladoctoracorazon.net
prettyassframes.com
meetyourwish.com
achefskiss.com
parulata.com
thang8-freefirevn2.xyz
statuniverse.com
autotenis.com
gosales.solutions
cryptocurrencymegalodons.com
anelimplus.com
oceanama.com
hagisiran.space
mphsalvageandrecovery.online
alluvionsupply.com
englishteachers4you.com
talkinghorseequine.com
alium-locum.com
musictechnologyshow.com
linjitejituan.com
fullmoondreams.com
csltzs.com
testovulacion.net
saboortii.com
tuyavietnam.com
localkaza.com
mppleague.com
ecomwealthfast.com
escariot.net
oceanpowerclub.com
thecraftssisters.info
pekinghousetntogo.com
avtnywveba.club
bf-milestone.com
sundeckofwashington.com
xn--clnicaimplantcenter-m1b.com
adenikitchen.com
ironolink.com
whyiteachpodcast.com
landscapedesignvalley.com
twobluemagpies.com
uovuesax.icu
willowlandingmarina.com
dy-bxg.com
yogacomsolutions.site
tootandscoot.com
newteethok.com
watchtherainbow.com
bazacar.com
alassalahgroup.net
sabioconteudo.com
Targets
-
-
Target
Payment - Swift Copy.exe
-
Size
878KB
-
MD5
373529da43706b9b230586b501a000fd
-
SHA1
d1a0ad8fe1c1adc9d27b5ceb3d7d27c9512c5495
-
SHA256
49e40687ad1ffb7ba491d92cd38333d3e96c134ba7739dcdd3e8ee2ea1b19506
-
SHA512
f5ba8fbb2409decc4982c5b9d0c7f6b479e8f184af33e99333b23fbfd493888477aa0442bf58290439bda2b2b26fa729aa6e6d0e2fa6ebe8cd23f0f916a4a085
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-