General
-
Target
BANK RECEIPT.gz
-
Size
219KB
-
Sample
210504-3wd2j5cq3x
-
MD5
01914c12d145f25ecd92eb346ea13c15
-
SHA1
9054f4bfa04d897d8d7686bde3d67e3f9afe9d7a
-
SHA256
f13a70ac5752be9d6cd680dce689311d13693d1d71df977729ff61aca27896ff
-
SHA512
37fd2ae3f16b0a097720c7a85765b2a11bddd0a4cda618d20e5bcfa446e702f8e21c07c66f09e08ad60da4ef4e5c0bc92d9c5aaf2c8748820ac789da604893f6
Static task
static1
Behavioral task
behavioral1
Sample
BANK RECEIPT.exe
Resource
win7v20210410
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Targets
-
-
Target
BANK RECEIPT.exe
-
Size
280KB
-
MD5
6317a0b98ebd6f0ba716fc1b73b4bf31
-
SHA1
6f593ad2588b2ca2e561f0b47c9654df9fd95932
-
SHA256
a2e99d0aabd8f0ad83b885eccf313563526a58b2da435bf34dad29294c712efe
-
SHA512
e29265b8cc385be1c86751dd04dd2a70d727e8e298cd0d0ca250c2c6515c8d1c189511c564de11cf9c3c85d3efed1e23f7ad4b91bcca156b6b7c4341195f449a
-
Formbook Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-