General
-
Target
FHT210995.exe
-
Size
350KB
-
Sample
210119-t96wemxf6e
-
MD5
c8f1dc4896822a9c3bbfbd1880f4fc1b
-
SHA1
41f803431c6a5dcc062a8c8cf8ba80e90a09f717
-
SHA256
c2aa09fda8ed6089db384994dc58fe814ff5a725ea05cd1ccca910b0d901301a
-
SHA512
dcdaacdbb766d976750ce7053b271292169263bc4deb4f49189e365f475695ece10ad63955acb526db754b5b6ab08573e8be5ce4d42ada1e7834ea5a3b3a4f75
Static task
static1
Behavioral task
behavioral1
Sample
FHT210995.exe
Resource
win7v20201028
Malware Config
Extracted
formbook
http://www.tzmm.net/wpsb/
0817ls.com
drawbeirut.com
respiteready.com
yufkayurek.com
poss-plus.com
distributesimilar.com
mcmendzlawns.com
bingent.info
wellnessandcomfort.com
humilityhope.com
recetasfes.com
olala.asia
epochryphal.com
room-lettings-onlines.club
lvc.xyz
reicolee.com
davidmarkphotovideo.photography
corpuschristicarbuyers.com
tutorialyoutube.com
ativ.pro
shopzayeska.com
collegeedgecoach.com
russillo.net
lxl-express.com
zadslogistics.com
newimpressionlighting.com
propertiesbyjose.com
potikha.com
phoenixoh.net
pogo-case.com
jordankylebowman.com
2020falafelburger.com
medicinas-enlinea.com
atypicaldesigncollective.com
aureliachic.com
woyaozijiawang.com
adrianapsicanalise.com
bubee-studio.com
musicalprofits.com
cafereuben.com
htxmobilewashndetail.com
hedgeanything.com
newbridgeclothing.com
3c.fitness
fastcincincinnatioffer.com
tiantipaihangbang.com
standupmankato.com
juggernautsbaseball.com
landoflostengineers.com
official-mr-bit-casino.com
hhzxwh.com
muafollow.com
realestatebymel.com
welvasq.com
medicalaccount.club
healthgain.online
xn--mkainternational-w3b.com
parkcrow.com
bazi45b.com
greenmatamp.com
zjksxy.com
homeinspectorbook.com
shelvesthatslude.com
smorapicnic.com
Targets
-
-
Target
FHT210995.exe
-
Size
350KB
-
MD5
c8f1dc4896822a9c3bbfbd1880f4fc1b
-
SHA1
41f803431c6a5dcc062a8c8cf8ba80e90a09f717
-
SHA256
c2aa09fda8ed6089db384994dc58fe814ff5a725ea05cd1ccca910b0d901301a
-
SHA512
dcdaacdbb766d976750ce7053b271292169263bc4deb4f49189e365f475695ece10ad63955acb526db754b5b6ab08573e8be5ce4d42ada1e7834ea5a3b3a4f75
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-