General
- Target SecuriteInfo.com.Trojan.Win32.Save.a.9130.4062
- Size 913KB
- Sample210507-3m1wgew23e
- SHA256 7653e46e3326fbabf9e534cbd02600f87ad38b5c9e4e175a60e27a6d90c5e6fe
- MD5 52289e533348a695d881c6df2d895f5e
- SHA1 2cc712357a0d94f590eb126f2697373d9cca4ea1
- SHA512 f456b1d29ed931fdc067973b76e586fd942baa0a26218c76cb2ea72a557e6fbaceba005846b366d3b3a998771e16e5b22147fcf4295a369da2240fe22a2d1b98
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Win32.Save.a.9130.4062.exe
Resource
win7v20210410
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.conciergedoctx.com/ot8m/
-
digiclan.net
-
songlautramtuoii.online
-
miracleseedproducts.com
-
taniacastillo.com
-
essentialme.network
-
charmcitydetour.com
-
suprekopis.com
-
jimmycollier.com
-
thrifteee.com
-
rhmachinery.ltd
-
the05project.com
-
altfacebookalt.com
-
ein-herz-fuer-holz.com
-
kingohost.com
-
vmarines.com
-
2bestudio.com
-
triducdv.com
-
kp-transport.com
-
mybostonhwart.com
-
benzcat.net
-
ajichouf24.com
-
aisoucheng.com
-
momagourmet.com
-
jj3977.com
-
modacimiz.com
-
akatsuki2017.com
-
mcallensolarpanels.com
-
totalsolarpanels.com
-
hamrahanedalat.com
-
littleavacadosco.com
-
personalloanspotterguides.info
-
pegasusdir.net
-
thetft.com
-
viscosetowels.com
-
erins.pizza
-
softlizer.com
-
ethicalcandleco.com
-
newactinc.express
-
premiumenterprisegroup.com
-
cwchsauce.com
-
emikosstore.com
-
milansclosetdoor.com
-
mpzazmrserv194.xyz
-
yelltee.com
-
cannabisclaim.com
-
jillsings.com
-
20bet9.com
-
byrondramos.com
-
rakovar.com
-
cqxyhpb.com
-
mycms.cloud
-
tutormenu.com
-
road35filez.com
-
restorationbydesign.net
-
leileinet.com
-
jumtix.xyz
-
devashrigreenssociety.com
-
sensationalwonderwomen.com
-
genesistc.net
-
rewibes.com
-
rockalingu.com
-
vipoboi.com
-
stewriley.com
-
yumleys.com
Targets
-
- Target SecuriteInfo.com.Trojan.Win32.Save.a.9130.4062
- Size 913KB
- SHA256 7653e46e3326fbabf9e534cbd02600f87ad38b5c9e4e175a60e27a6d90c5e6fe
- MD5 52289e533348a695d881c6df2d895f5e
- SHA1 2cc712357a0d94f590eb126f2697373d9cca4ea1
- SHA512 f456b1d29ed931fdc067973b76e586fd942baa0a26218c76cb2ea72a557e6fbaceba005846b366d3b3a998771e16e5b22147fcf4295a369da2240fe22a2d1b98
- MD5 SHA1 SHA512
Formbook Payload
Suspicious use of SetThreadContext