General
-
Target
r.rar
-
Size
759KB
-
Sample
210504-np2wkd9v46
-
MD5
61c631192561a35a471641ea076348aa
-
SHA1
f2848a5ab08673d467ecef0709b9c93f74a0aa18
-
SHA256
1ebcadef0f2790a5c28cc8d6100007eb6a82a0cf7fc582e7595fa9a3407d3049
-
SHA512
795d8401fe49a7cefd1ede1e365f030f005bad5a88db4114dafaf697ae535c94bfbe1982e47e007daf565e284596792d27af05fd4bfb55d7554d6e0b7b70dcde
Static task
static1
Behavioral task
behavioral1
Sample
BANK RECEIPT.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
BANK RECEIPT.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
PO.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
PO.exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
STATEMENT OF ACCOUNT.exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
STATEMENT OF ACCOUNT.exe
Resource
win10v20210410
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Targets
-
-
Target
BANK RECEIPT.exe
-
Size
280KB
-
MD5
6317a0b98ebd6f0ba716fc1b73b4bf31
-
SHA1
6f593ad2588b2ca2e561f0b47c9654df9fd95932
-
SHA256
a2e99d0aabd8f0ad83b885eccf313563526a58b2da435bf34dad29294c712efe
-
SHA512
e29265b8cc385be1c86751dd04dd2a70d727e8e298cd0d0ca250c2c6515c8d1c189511c564de11cf9c3c85d3efed1e23f7ad4b91bcca156b6b7c4341195f449a
-
Formbook Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-
-
-
Target
PO.exe
-
Size
228KB
-
MD5
2593eef7b38e160b9697f2479fa8843f
-
SHA1
25d4d88f321321fb5b2b316fd5dbcd5bb144daa1
-
SHA256
b35de004189f271fe754dd614e5fbbc299425f5aca9ebf1f935bf26696964853
-
SHA512
c5beb57aae9c18ca5d7d73954216abc6a07871666d08a654d7b5d8e1d25b0defe9ca66eee77325bed03870a39757c85df13f868472447369bd2903ba05336a21
-
Formbook Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-
-
-
Target
STATEMENT OF ACCOUNT.exe
-
Size
387KB
-
MD5
5932bd9d5a231f2dce386609a1c80ba9
-
SHA1
94b257813d301d75895d0fee69a8acc224cca82e
-
SHA256
14e48e373fee4fafef99517fba97e5ea5727f764a0b92509b307f9387679dd64
-
SHA512
c10ca6caa068086aef9e36aab1ec8ae9f83367a30fa213d54fcfd5c77f0115e1b4017ddb77cf28bae3761d75ee0118241eb413613cecf4431820d526a7ba967c
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-