General
- Target Scan Copy.exe
- Size 587KB
- Sample211118-rmw39ahae6
- SHA256 5dad6b254fb40bb4c090f5048e07da656821a4b6b163c6548287c3d91dcfda45
- MD5 bc18a6a568b4055d62b94f34cccdfdfe
- SHA1 a5c11ea0876119ba95d2c63c725d4fdc4f864b71
- SHA512 1131c55ec0450736873fcd2f0bd5b131f504be0429f0ee9168c0fe0b7d0fd07829d988b4be0285d052d71a9e0583ca8488aa45f1e98ca17b58f9bdb4188ac4d3
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Scan Copy.exe
Resource
win7-en-20211104
Malware Config
Extracted
-
formbook
-
4.1
-
b3n1
-
http://www.teslabotnews.com/b3n1/
-
alexandragrows.com
-
shellload.com
-
stanleyrorke.com
-
glasurit.us
-
facebookismetaverse.com
-
astoundingaffairs.com
-
facom.us
-
dysonsaleoutlet.us
-
obtengaunitedhealthcare.com
-
sebastianroofrepairs.com
-
saltvent.com
-
littleonesclub.com
-
webamazoncardshopmail.xyz
-
lutam.xyz
-
myfirstpsgame.com
-
comline.cloud
-
valueinsightfororacle.com
-
congregacionansestral.com.co
-
paypal-uk.xyz
-
facebookversuzmeta.com
-
hyveone.com
-
metaisfacebook.com
-
wordpressversnellen.com
-
sunnyleoneporn.xyz
-
firstfrontstudios.com
-
heytechmarketing.com
-
metaversefacebook.net
-
zirsys.com
-
pmstnly.com
-
metafacebooksnewname.com
-
theagency.black
-
freemetasitebuilder.com
-
tesla88.vin
-
thebitcoinfuturesetfs.com
-
mygiftedaffairs.com
-
qrbconsulting.info
-
gpactive.com
-
facebookvsmeta.com
-
poele-shop.fr
-
firstcallindia.xyz
-
uhcecetr.xyz
-
informital.com
-
areyouongoogle.com
-
lymou.com
-
firstlightadventuretour.com
-
feed-supportives.com
-
chasesecurobanking.com
-
prestigioinformativo.com
-
blogkaisebanayehindimejane.com
-
freedomto.co
-
oneonemeta.com
-
joinclosify.co
-
unitedkingdommeta.com
-
alexandrathiele.com
-
xn--wellsfarg-o7a.com
-
rockstarsyard.com
-
acd-informatique.fr
-
firststopbusinesses.com
-
loisirs-et-spectacles.com
-
babymassage.us
-
5ggooglecloud.com
-
gameone10668.com
-
parkdomainforsale.com
-
riverbcastmake.net
Targets
-
- Target Scan Copy.exe
- Size 587KB
- SHA256 5dad6b254fb40bb4c090f5048e07da656821a4b6b163c6548287c3d91dcfda45
- MD5 bc18a6a568b4055d62b94f34cccdfdfe
- SHA1 a5c11ea0876119ba95d2c63c725d4fdc4f864b71
- SHA512 1131c55ec0450736873fcd2f0bd5b131f504be0429f0ee9168c0fe0b7d0fd07829d988b4be0285d052d71a9e0583ca8488aa45f1e98ca17b58f9bdb4188ac4d3
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext