General
- Target Payment_swift advice.exe
- Size 597KB
- Sample211029-y2pfaaeah2
- SHA256 b94f5b293f83458293e899d5a76ca936cc4ea5d79913e3792cc25f08fda1a147
- MD5 bbcc7ec5a4f78cad98c07a3bd3eecfb9
- SHA1 10fe623ccd6b14cc30d1cd3ef191a08cabfa2ae2
- SHA512 2af01b47531b2bf46a87c7f9329775cebd75509988dcb50538e991631a853067fa38602c3609f38b109aa16607c42dfc870ae24cffe14c6a7b4775cccaae23df
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Payment_swift advice.exe
Resource
win7-en-20210920
Malware Config
Extracted
-
formbook
-
4.1
-
snr6
-
http://www.reynbetgirisi.com/snr6/
-
jjglassmi1.com
-
vpsseattle.com
-
drfllc.top
-
staycoolonline.com
-
eptlove.com
-
solusimatasehat.site
-
ionrarecharlestonproperties.com
-
b3eflucg.xyz
-
tvchosun-usa.com
-
mmahzxwzsadqlshop.life
-
gospelimport.com
-
demoapps.website
-
jackburst54.com
-
99rocket.education
-
ccbwithbri.com
-
trapperairsoft.com
-
useroadly.com
-
ralphlaurenonline-nl.com
-
loanmaster4u.com
-
champ-beauty-tomigaoka-nail.com
-
theripemillennial.com
-
123intan.net
-
typopendant.com
-
coruscant.holdings
-
bio-intelligenz-therapie.com
-
reprv.com
-
directreport.net
-
phinespe.xyz
-
xuvedae.site
-
idilikproperties.info
-
wakigaggenin.com
-
mal2tech.com
-
nftwhaler.xyz
-
gxhnjssx.com
-
ozba.xyz
-
lecupcake.net
-
lucid.quest
-
kaleoslawncare.com
-
tiew.store
-
texcommercialpainting.com
-
2152351.com
-
likewize-xl.com
-
dacooligans.com
-
manuelmartinezs.com
-
beancusp.com
-
barbershopvalleyvillage.com
-
southwickfunerals.com
-
briellebaeslay.info
-
rebeccarye.com
-
unitedstateswelders.com
-
saudiarabiavegan.com
-
testcarona.com
-
serverapsd.com
-
crickx.email
-
hdszbj.com
-
bennettmountainoutfitter.com
-
leileilei1999.xyz
-
baroquefolke.com
-
francinegeorges.com
-
horpces.online
-
resolutionfix.com
-
mike-schultz.xyz
-
sohutobankueahomupezinkv.xyz
-
flowerseedqueen.com
Targets
-
- Target Payment_swift advice.exe
- Size 597KB
- SHA256 b94f5b293f83458293e899d5a76ca936cc4ea5d79913e3792cc25f08fda1a147
- MD5 bbcc7ec5a4f78cad98c07a3bd3eecfb9
- SHA1 10fe623ccd6b14cc30d1cd3ef191a08cabfa2ae2
- SHA512 2af01b47531b2bf46a87c7f9329775cebd75509988dcb50538e991631a853067fa38602c3609f38b109aa16607c42dfc870ae24cffe14c6a7b4775cccaae23df
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext