General
- Target Additional Agreement 2020-KYC.exe
- Size 580KB
- Sample201107-c8aedqbcha
- SHA256 8c0577ec4537880647e232dc1c3b0c722bb1efc0f8f4ea99729ed3607a1dace2
- MD5 489a558c25cbb4e89ed813f1c90ee4bd
- SHA1 7b61fa642d6b167c95e91ad85bb6f984e5ae2d53
- SHA512 f4e442a62df0976388033e8682b4fc42c7e16f55e80c68642e99830d7c3e5ce4857e98719c956f706326bb5cdc60bd82ad0adef8d78200f05e871132e70ade9b
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Additional Agreement 2020-KYC.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.csgo-c4ses.com/bw82/
-
orchid-iris.com
-
owner.codes
-
crispcleanbodyrituals.com
-
nocreditcarswestpalm.com
-
sweetsasu.com
-
downlooader.com
-
candleish.com
-
43414newportdr.com
-
78kanshu.net
-
tncnn.com
-
bcheaptvwd.com
-
trephone.art
-
aloharecords.com
-
latinaexpres.com
-
comminterbusiness.com
-
evokingcalm.com
-
mckarthylabscoe.com
-
make-trends.com
-
modernhomeskitchen.com
-
mousybusiness.com
-
dentonparalegals.com
-
dreammakeloja.com
-
caffeinatedmamasblog.com
-
stockandbarrell.com
-
tesla-commercio.com
-
friendsofhersheypa.com
-
sajjaddeveloper.com
-
roechling-roding.run
-
ruffstuffstore.com
-
monnetier-mornex.com
-
aplustd.com
-
hjscinc.com
-
riquimbilis.com
-
free-outlet.com
-
mail-businessprinting.com
-
xzaztlrl.icu
-
artofsapna.com
-
mercyvh.com
-
beauskitchen.com
-
amq-studio.com
-
whentime12.com
-
helptechservices.com
-
erraticer.com
-
nationalreturnday.com
-
justincook.xyz
-
shopjrock.com
-
breakfastcandy.net
-
penislandbrews.com
-
fjweiwang.com
-
mosterth.com
-
xn--gdask-y7a.com
-
packorganically.com
-
greaterdiabetes.info
-
neotactic.net
-
tiedcaps.rest
-
prandartsagency.com
-
tdmmk.site
-
octoberx2.online
-
idealgaysex.com
-
devitasaude.com
-
tatsunoichie.com
-
amazonprim8.art
-
mcwildwest.net
-
sewythingy.com
Targets
-
- Target Additional Agreement 2020-KYC.exe
- Size 580KB
- SHA256 8c0577ec4537880647e232dc1c3b0c722bb1efc0f8f4ea99729ed3607a1dace2
- MD5 489a558c25cbb4e89ed813f1c90ee4bd
- SHA1 7b61fa642d6b167c95e91ad85bb6f984e5ae2d53
- SHA512 f4e442a62df0976388033e8682b4fc42c7e16f55e80c68642e99830d7c3e5ce4857e98719c956f706326bb5cdc60bd82ad0adef8d78200f05e871132e70ade9b
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext