General
- Target Swift.exe
- Size 733KB
- Sample210905-klfljshde8
- SHA256 e99ee0d03ae293aec74c31a6db628d9fe12be9699365ebf71de4b2bf6e8ca0d5
- MD5 4e2796a2868b3c747df7d5c5bc359caf
- SHA1 7219dc2e9a2980e60229dc32d303d158cf56a195
- SHA512 5292b4d07c662639359e1861a0d0380d939f118b3632e66bf70a00c7347ec09689b886cb6d455ff0a392639302da28854ac1fc84b535e2d63aa5726268d6ce57
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Swift.exe
Resource
win7-en
Malware Config
Extracted
-
formbook
-
4.1
-
pm7s
-
http://www.rafaelcristino.com/pm7s/
-
angrypeacocks.site
-
theindependentartlable.com
-
coachingforthewin.com
-
localbizsc.com
-
drive-a-supercar.com
-
mewsette.com
-
scinuh.com
-
gurugramaffordablehomes.com
-
riamedefarm.com
-
richfitzfashions.com
-
u9j1o.info
-
dife-rent.com
-
talesfromthequadrat.com
-
dandfmotors.com
-
springtexasdentist.com
-
gobakala.store
-
earlyeducationglobal.com
-
sdrxsb.site
-
dreamlifebiz.com
-
theurbancaveshop.com
-
rojkikhabar.com
-
honeycreek-vision.com
-
robinnicholsrealty.com
-
orilliatownhouseteam.com
-
ipedal.xyz
-
ropemillcreekpaddleboarding.com
-
monbeauchien.com
-
achtsamkeit-in-der-schule.com
-
towtruckperth.com
-
shijijiaoyou.com
-
belangespiritualstore.com
-
gmignitionswitcheconomicset.com
-
tracelanelog.com
-
infiniteavionics.com
-
kornfelder.com
-
unnsa.xyz
-
billonblocjs.com
-
savingcambodia.com
-
darienkitchens.com
-
ecetonline.com
-
softcenchina.com
-
eu-global.space
-
americajustsayit.com
-
getverthanger.com
-
arrowlankaexports.com
-
xn--uds17hya4f549f40d.com
-
btlbusinesscoaching.com
-
aktive.net
-
awkamga.com
-
borostamas.com
-
tuolum.net
-
tnshomebuyers.com
-
signatureperformace.com
-
s16.solutions
-
thethoughtrecord.com
-
onexotyland.com
-
deintuning.com
-
wellrecognizewell.com
-
rugpat.com
-
shellieclarksonsbeautique.com
-
cevicheatl.com
-
usasbe.com
-
listenonrepear.com
-
qanoonpharmacy.com
Targets
-
- Target Swift.exe
- Size 733KB
- SHA256 e99ee0d03ae293aec74c31a6db628d9fe12be9699365ebf71de4b2bf6e8ca0d5
- MD5 4e2796a2868b3c747df7d5c5bc359caf
- SHA1 7219dc2e9a2980e60229dc32d303d158cf56a195
- SHA512 5292b4d07c662639359e1861a0d0380d939f118b3632e66bf70a00c7347ec09689b886cb6d455ff0a392639302da28854ac1fc84b535e2d63aa5726268d6ce57
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext