General
-
Target
Xyxwnf_tbthqia.exe
-
Size
629KB
-
Sample
210419-vadw6c9rge
-
MD5
5349bc9a993c0f27f680df6ae615e25b
-
SHA1
a09fba1651560d79c73454972541b46127f79cf3
-
SHA256
c7391ce67453425e0a0c70317b07166d7eae0ee6d6af726200a1cc65c8217a55
-
SHA512
077dad741dc6cefaf6f579220974165622b9ad2991a1526dd8d653325e972e35a90903fa642cecfa5a73fcbcb8e71a70f7165e0b6ebbc709280615725e36aed1
Static task
static1
Behavioral task
behavioral1
Sample
Xyxwnf_tbthqia.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Xyxwnf_tbthqia.exe
Resource
win10v20210410
Malware Config
Extracted
formbook
4.1
http://www.electronicservicesonline.com/jsyp/
chernigiv-quest.com
s-sashenzhen.com
curedtherapy.com
esketamine.doctor
advantagehail.com
greensolartechinternet.com
omaybread.com
afrocanlinks.com
luisxe.info
qygmuakh.club
mutlulukdileriz.net
lifelineglobalministries.today
aaa1roofing.com
bestcoworker.com
exclusiveoffer.bet
answerwill.com
canelonni.com
getuvewedre.com
mrhotelsthailand.com
brabantinecityrow.com
sparklycraze.com
thelungans.com
vivibrand.com
healthfromtheoutsidein.com
thelibraryofspice.com
stroudrealty.com
benfit-help18.club
cbg-hemp.com
ussnowbirds.com
stonetoweradvisory.com
gulfsouthequipmentsales.com
kosmolottosports.com
tchool.net
bestcuttingtools.com
ebn1.com
nilohoney.com
mamatyarirenntaru.club
tennissteustache.com
gradarquitectos.com
wwwmysweetapple.com
openupfuture.com
hieron.art
zgqclbuj.com
registro-digital-1bn.xyz
ayurpreneur.com
newyorkfishingcompany.com
pnkhotels.com
uplender.net
peacebeyourjourney.com
progressher.com
homebrewsupermarket.com
alliancecorporateconsulting.com
baoxinsm.com
christinaliew.net
euygunfirmalar.com
novelty-fishing-products.com
oorheersing.com
lottojoongsim.net
drmebpc.xyz
ploycraftmc.com
lifeimproviser.com
nukestate.com
cazaferry.com
manojmusic.com
Targets
-
-
Target
Xyxwnf_tbthqia.exe
-
Size
629KB
-
MD5
5349bc9a993c0f27f680df6ae615e25b
-
SHA1
a09fba1651560d79c73454972541b46127f79cf3
-
SHA256
c7391ce67453425e0a0c70317b07166d7eae0ee6d6af726200a1cc65c8217a55
-
SHA512
077dad741dc6cefaf6f579220974165622b9ad2991a1526dd8d653325e972e35a90903fa642cecfa5a73fcbcb8e71a70f7165e0b6ebbc709280615725e36aed1
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook Payload
-
Adds policy Run key to start application
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-