General
-
Target
SOA.exe
-
Size
740KB
-
Sample
210223-matnc28ess
-
MD5
1d3573643db9a59abcd6b937a33d1f28
-
SHA1
7a00cb31b78616ed1f58cd3550d3ab47a2d66e4a
-
SHA256
8eb77ec70c44e86607e97ce926cdb4e0610a0199c348fa329dba50bef34d5fc1
-
SHA512
a4fc37960b23374d5a2fdf0e5013719a87dd5c90f7deca11ada4215db6ce1f44249f1bc1ec0b9f7071f6d3589dcef725037bf4a50147c5da02c29860b25bbc9f
Static task
static1
Behavioral task
behavioral1
Sample
SOA.exe
Resource
win7v20201028
Malware Config
Extracted
formbook
http://www.fun4gang.xyz/thg/
retrospectphotographydesign.com
jafodraws.com
cigiwie.space
upgradecarehealth.com
12ts.xyz
111indianbend.com
qqchbakery.com
0831xx.com
supecret.com
ayfadopple.com
coldwateradvisors.com
forexgiftcard.com
actionconsultingchile.com
mpsconcrete.net
carmallc.com
b167888.com
simonking.xyz
elitedigitalperformance.com
essentialjanitorialservices.com
barcosocasionberga.com
skyboxorganics.com
luewedrware.com
gypsybrandswag.com
v-surf-boards.com
maxbeautypro.com
bellahappy24.com
translatemyanmar.com
streemsex.com
wql.xyz
2002sport.xyz
septerrallc.com
pk30jpt5n.xyz
propurposepivot.com
vietristore.com
ghyperdigital.com
peau-parfaite.com
hdhldance.com
restaurantweeknepal.com
ww-tree.space
svim.net
flowersforeveraz.net
victormsalazar.com
sinaates.store
photomagazineextra.com
427557.com
regenerativesouls.com
lovestsintao.space
hyweljones.net
rogerbyronlaw.com
retirocard.com
jeterfurniture.com
chekax.com
fryare.info
themarronteam.com
gravitonbeam.com
writinglover.site
theroyaltot.com
blackberry-fr.com
healthpanel.net
diplomx-vo-vladivostoke.com
cftongxing.com
minadoasfalto.com
tokogrosirjaya.com
szmingfang.com
Targets
-
-
Target
SOA.exe
-
Size
740KB
-
MD5
1d3573643db9a59abcd6b937a33d1f28
-
SHA1
7a00cb31b78616ed1f58cd3550d3ab47a2d66e4a
-
SHA256
8eb77ec70c44e86607e97ce926cdb4e0610a0199c348fa329dba50bef34d5fc1
-
SHA512
a4fc37960b23374d5a2fdf0e5013719a87dd5c90f7deca11ada4215db6ce1f44249f1bc1ec0b9f7071f6d3589dcef725037bf4a50147c5da02c29860b25bbc9f
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-