General
-
Target
HSBC_PAYMENT_COPY.pdf.exe
-
Size
1.4MB
-
Sample
210727-c8b86fmz9a
-
MD5
08f2609e7f7daf0f78032f773a68b72c
-
SHA1
f00e4c61cce15ee5f43c032d8d595aba65fbdc86
-
SHA256
0ed8f93b98f9cfff89559df9e0a8d360cab3dde1abfa2992216b4a98c5ca1253
-
SHA512
8c1ba503d2956ad0c60b11547908b81e601a3bfb2c75ae73c03718bd883ff94451b0697f915049614470d59388d161c02893ad90b48466f77fc154a20215da74
Static task
static1
Behavioral task
behavioral1
Sample
HSBC_PAYMENT_COPY.pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
HSBC_PAYMENT_COPY.pdf.exe
Resource
win10v20210410
Malware Config
Targets
-
-
Target
HSBC_PAYMENT_COPY.pdf.exe
-
Size
1.4MB
-
MD5
08f2609e7f7daf0f78032f773a68b72c
-
SHA1
f00e4c61cce15ee5f43c032d8d595aba65fbdc86
-
SHA256
0ed8f93b98f9cfff89559df9e0a8d360cab3dde1abfa2992216b4a98c5ca1253
-
SHA512
8c1ba503d2956ad0c60b11547908b81e601a3bfb2c75ae73c03718bd883ff94451b0697f915049614470d59388d161c02893ad90b48466f77fc154a20215da74
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload
-
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-