General
-
Target
SUNEJ PAYMENT.exe
-
Size
939KB
-
Sample
210117-l8yn9qfvys
-
MD5
b6b8a1ad3d8f308457b07b88afeab4cd
-
SHA1
f49329c30a3870c5b4c0b988197045140a6d5c23
-
SHA256
7aa2116b5dcb055987e0e18b5e2f869eae15f6093adfd55b6a6d28b8be53dcb4
-
SHA512
7fc6887f80879d04ceac0b4a59f9cb5161a8f52474afa4f14394051ff4d2c2a63e9afd1729824a8ac39c4767e56a086e70072b4913096e3a1c18e8c26451b6d7
Static task
static1
Behavioral task
behavioral1
Sample
SUNEJ PAYMENT.exe
Resource
win7v20201028
Malware Config
Extracted
formbook
http://www.a-emeservice.com/m8ec/
thomascraigwealth.com
melbournemedicalhealth.net
tdxcoin.com
lukassbprojects.net
aldemallc.com
moqawalat-kuwait.com
txcsco.com
jobcarepro.com
sedotwcmedanmurah.com
niconthenine.com
radliffrehab.com
infiniteechogroup.com
stellantis-luxury-rent.com
ibusehat.info
resellerauctions.com
softwarexprogrammers.com
bumpnlifestyle.com
mintmacher.com
partapprintercare.com
justrightinsurance.com
beyond-ml.com
mikrotandborste.com
madisonmeadowsseniorliving.com
smart14day.com
fiftyfivetwelve.com
respectinvestadvance.com
shelleylutherfortexas.com
kunst-stueck-chen.com
adastraperaspera.xyz
aletheaastraea.info
zhghzlg.com
cameroncooperar.com
inrushconsulting.com
oldeny.com
foggardens.com
bubbygoobers.com
apartmentnegotiator.com
iregentos.info
charlesadoptionhome.com
sugawara-garasu.com
insidescripps.net
offerlamp.com
flagpeel.com
tb1919.com
estherneil.com
greatunsearchablethings.com
jeunetherapie.com
ricardoinman.com
sbq58.com
morifan.com
foodpukka.com
onewaytaxi.club
ksolves-vendor.com
ashleighemmaboyle.com
hbseelong.com
vanotti-watches.com
faizulrahmanmusafir.com
cb5677.com
gcasservices.com
perteprampram01.com
308hamlinloop.com
machkind.com
cwpdhambers.xyz
glenwoodsteak.com
Targets
-
-
Target
SUNEJ PAYMENT.exe
-
Size
939KB
-
MD5
b6b8a1ad3d8f308457b07b88afeab4cd
-
SHA1
f49329c30a3870c5b4c0b988197045140a6d5c23
-
SHA256
7aa2116b5dcb055987e0e18b5e2f869eae15f6093adfd55b6a6d28b8be53dcb4
-
SHA512
7fc6887f80879d04ceac0b4a59f9cb5161a8f52474afa4f14394051ff4d2c2a63e9afd1729824a8ac39c4767e56a086e70072b4913096e3a1c18e8c26451b6d7
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-