General
-
Target
SWIFTY COPY.exe
-
Size
745KB
-
Sample
201204-zxmadjl8w6
-
MD5
b848cc9c799857387b279d773e4250df
-
SHA1
13c7f4df965698c1a8b10ced41ddec295f8634bb
-
SHA256
b6247c787ec362f884203a581049a638a59a9db8dc6bac8cb88869a45704dfc9
-
SHA512
48bfc3059a52bbe2668497b68747717e97f493aac40cd7900da337c72ed2ccb7e096b6e776bfcd8c79b3f1a7049d4bf4a3cdf5475c4395412766cefc105ee7bb
Static task
static1
Behavioral task
behavioral1
Sample
SWIFTY COPY.exe
Resource
win7v20201028
Malware Config
Extracted
formbook
http://www.alsagranit.info/rhk/
luuthingoctrinam247.online
upcas.info
cmoswipefiles.com
rene-jew.com
kiddoslunchboxes.com
52wanlol.com
konstela.com
dajiangzhibo11.com
huibaoyuanhty.com
boudot.one
myinfinitycollectionagency.com
letsgetsunny.com
gruppolarta.com
factoka.com
artistspal.com
gewnrecaalouine.com
etiquetadorada.com
brememshop.com
kangyiyan.com
testcitestdpp03.com
kredit-goals.com
ujinent.net
copycatchgold.com
primospicaduras.com
qualitydiscountauto1.com
globalindustrysource.com
kergrandmaman.com
hirerevert.com
appislim.com
card-hotel-family-enjoylife.com
struckmelikeachord.com
sensesfits.store
bygabrielletiara.com
nopmirefinance.com
dfscapholdingsllc.com
cincysanitizing.com
luxuryresortranch.com
otter.coffee
yourfac.club
kemalyaz.com
longhu152.com
globale.solutions
thedetroitmasquerade.com
dynastyroyal.com
qnbpjnp.icu
cora-musica.com
testcokes.com
k-eco.net
jamjshcnsg45.com
forsythcourtseniorliving.com
smallfrytacos.com
delta8cbd.today
nfmprotecton.com
mtrlx.com
gouvrefund.com
moneybook4nurses.com
loanadminisraion.com
canadafaucetoutlet.com
pdgulu.com
lyoml.com
goimang-4gviettel.site
saimeisteel.com
replace-study.com
macomo.online
Targets
-
-
Target
SWIFTY COPY.exe
-
Size
745KB
-
MD5
b848cc9c799857387b279d773e4250df
-
SHA1
13c7f4df965698c1a8b10ced41ddec295f8634bb
-
SHA256
b6247c787ec362f884203a581049a638a59a9db8dc6bac8cb88869a45704dfc9
-
SHA512
48bfc3059a52bbe2668497b68747717e97f493aac40cd7900da337c72ed2ccb7e096b6e776bfcd8c79b3f1a7049d4bf4a3cdf5475c4395412766cefc105ee7bb
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-