General
- Target Confirm.exe
- Size 819KB
- Sample201229-wt7kyym432
- SHA256 a2d9b5d16fcae146b34d3ed40bb6444d4b4bb497ed63e8f4d720af4d24cb5450
- MD5 85cae42607ba1f967e4dbc6eb164b10c
- SHA1 a4f6a236211877a1643e4e23b526a92783e95ec5
- SHA512 a5be8c40380f6448e1d2d558b05d07558e51df4f0ca166bb24aba682dc1fecfbe47a94ef10adb275834885f7b254ec85f452a3ce33b08980b80fda5d08740da5
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Confirm.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.deuxus.com/t052/
-
ladybug-learning.com
-
unforgottenstory.com
-
oldmopaiv.xyz
-
natashaexim.com
-
hannahmcelgunn.com
-
retargetingmachines.info
-
njoconline.com
-
unicornlankadelivery.com
-
giftkerala.com
-
englishfordoctors.online
-
schatzilandrvresort.com
-
brujoisaac.com
-
basiccampinggear.com
-
escapees.today
-
dgyxsy888.com
-
stevebana.xyz
-
mimozakebap.com
-
ezdoff.com
-
pluumyspalace.com
-
shaoshanshan.com
-
crazyvine.wine
-
sfjt55.com
-
xjgqh.com
-
netverificatie-home.info
-
efnew.com
-
welderweb.com
-
2ndstars.com
-
parrotpink.com
-
sarahjanehammock.com
-
pizzawestpalmbeach.com
-
pivot-branding.com
-
bribiebootcamp.com
-
floridaincontinencetherapy.com
-
muddanyc.com
-
pflegedienst-24-7.com
-
kunstradar.com
-
coolgadgetsdominate.com
-
comedynationlive.com
-
workoutandlawn.com
-
orangecountyvolvolease.com
-
sunrisemath.com
-
premiumenterprisegroup.com
-
mnglobalplatform.com
-
bijie.xyz
-
christiandailyusa.com
-
kismetestatestjohn.com
-
bobyworks.com
-
h2cooker.com
-
kimquint.com
-
torturechamberproductions.com
-
superbbsuper.com
-
bibleandkoran.net
-
oncuecollective.com
-
strat-fundamentals.info
-
taichi.chat
-
beautyroomgreenwich.com
-
686761.com
-
prostatamrt.net
-
medicina-genomica.com
-
hl022.com
-
forestlawnfunerals.com
-
charismayachts.com
-
sublimequalitystore.com
-
bowvacare.com
Targets
-
- Target Confirm.exe
- Size 819KB
- SHA256 a2d9b5d16fcae146b34d3ed40bb6444d4b4bb497ed63e8f4d720af4d24cb5450
- MD5 85cae42607ba1f967e4dbc6eb164b10c
- SHA1 a4f6a236211877a1643e4e23b526a92783e95ec5
- SHA512 a5be8c40380f6448e1d2d558b05d07558e51df4f0ca166bb24aba682dc1fecfbe47a94ef10adb275834885f7b254ec85f452a3ce33b08980b80fda5d08740da5
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext