General
- Target shaco.exe
- Size 269KB
- Sample220413-qqm43scdb5
- SHA256 38c909bf15fc21291bb3bda3e4c56b117bc9810a85508eb46308b5ebcccd2719
- MD5 5d7e191c73f740b77dbc5dfd2d2af31b
- SHA1 ab721e09a0cceffe597fca7cc42fb0c191e2883b
- SHA512 5694a4351027a5351b9c4c3f1f45fd75a11f77345a8ceb81e6ac9d631a1173bb6095cc15dc06b6908d8a38e093d910e1a41df4380a2a787c3c14b8fac5f85362
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
shaco.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
shaco.exe
Resource
win10v2004-20220331-en
Malware Config
Extracted
-
formbook
-
4.1
-
sy2h
-
guwudy.com
-
dpcpodcastnetwork.com
-
dzjfl.xyz
-
metavsarena.com
-
7963.win
-
myplayerdevelopmentsystem.net
-
cabcus.com
-
lordofmoney044.xyz
-
bxtrace.online
-
adenyean789.com
-
maghreboundation.com
-
zbicvbo.xyz
-
lifeimpressions.art
-
mbossefootballclubacademy.net
-
zhengswl.com
-
kcjinfra.com
-
lemonshopee.com
-
knowinggod.world
-
9e2e.com
-
dahoambau.com
-
barigoodlivingvsa.com
-
ionclicks.com
-
omnivirse.xyz
-
doorcountycadle.com
-
successfeed.net
-
guttercatmint.xyz
-
jacksonbrothersseptic.com
-
jsccglass.com
-
norapparel.com
-
pocc.info
-
engineerleveling.com
-
neonature.site
-
rodriguezhomesales.com
-
goldenknights.systems
-
sungardcapital.com
-
juyouzhifu.com
-
vailvalleylandscapesupply.biz
-
forkmylifellc.com
-
aliexpressorder.net
-
vwtcrrm.site
-
rentsalot.com
-
caffmototx.com
-
iidoag.xyz
-
bom52.vin
-
davidpugahomesale.com
-
6py.xyz
-
titancarmount.com
-
seoba88.com
-
petsippliesplus.com
-
twdhefy.com
-
cvelocity.com
-
wwwvip14b.xyz
-
mesinjilid-lempanas.com
-
yummybodycreations.com
-
happinessmania.com
-
groundbreakcoalition.net
-
comi4.xyz
-
dbysapi.com
-
mariolagardner.com
-
entourageaid.com
-
seesea-sh.com
-
stopitnow.xyz
-
hgnnt.com
-
mikeyriley.com
-
bluedotair.com
Targets
-
- Target shaco.exe
- Size 269KB
- SHA256 38c909bf15fc21291bb3bda3e4c56b117bc9810a85508eb46308b5ebcccd2719
- MD5 5d7e191c73f740b77dbc5dfd2d2af31b
- SHA1 ab721e09a0cceffe597fca7cc42fb0c191e2883b
- SHA512 5694a4351027a5351b9c4c3f1f45fd75a11f77345a8ceb81e6ac9d631a1173bb6095cc15dc06b6908d8a38e093d910e1a41df4380a2a787c3c14b8fac5f85362
- MD5 SHA1 SHA512
-
Formbook Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext