General
- Target TT copy for our Payment.exe
- Size 563KB
- Sample211029-n3fvesdca2
- SHA256 fcb7e25d33700d8f04ab05d2fc0cba77dc5ccf6a32b93abc3511dcfb608dbc9e
- MD5 40f14c49b952aa5ff20f9679f1bd13e1
- SHA1 78529e67ac1d3cde77de6fe7fb5d99471f02e388
- SHA512 aa6353888924157cec5bac5357591b9e6d344c8a89c032e97bcf1f230a76b90ae758993be2bfc2ca6d929ab2cb708389647e7dd2d6e9afc844675a1d7a042107
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
TT copy for our Payment.exe
Resource
win7-en-20210920
Malware Config
Extracted
-
formbook
-
4.1
-
r4gk
-
http://www.aprilsaak.quest/r4gk/
-
quantalix.com
-
animalblog-eggs.com
-
039skz.xyz
-
guttas.net
-
lasantadayparty.com
-
protegerfinanceservices.com
-
vixtest.xyz
-
digitaleconomy.global
-
0xpax.xyz
-
mobilehome1688.com
-
themotionpartners.com
-
valueney.com
-
hattuafhv.quest
-
js0061gj.net
-
360metaverse.biz
-
seculardata.com
-
346727688.xyz
-
smartmapom.com
-
moksel.com
-
exoduswatchco.com
-
cryptopazar.com
-
constructioncdr.com
-
teamlsu.club
-
vitalflowscam.com
-
participatetn.info
-
daysyou.com
-
beautifulhandwriting.net
-
risccredit.com
-
coachingwithkyle.com
-
tedthemusicguy.com
-
theukulelejournal.com
-
enpratikyemektarifleri.com
-
reaching-far.com
-
investmentcomp.com
-
digitalzonecorp.com
-
internet-treat.com
-
oligopoly.club
-
thepropertiesmatterlawfirm.com
-
jsi.money
-
8mlcvtd4y.com
-
tjc075kcn.xyz
-
floribunda.space
-
clinpic.com
-
zhizhengsf.com
-
thebestsmartphones.com
-
robertaeelton.com
-
upcxi.xyz
-
graywolfdesign.com
-
elitespeedco.com
-
asia99.asia
-
021parkert.com
-
seo-clicks7.com
-
com103940689794.icu
-
thegisguru.com
-
api-22nnys.com
-
srothientu.com
-
hfhcatering.com
-
strukuwehtet.quest
-
extramovies.quest
-
monamodda.com
-
markbuyskes.com
-
smartar8.xyz
-
illarrivelatebut.space
-
gestionestrategicadl.com
Targets
-
- Target TT copy for our Payment.exe
- Size 563KB
- SHA256 fcb7e25d33700d8f04ab05d2fc0cba77dc5ccf6a32b93abc3511dcfb608dbc9e
- MD5 40f14c49b952aa5ff20f9679f1bd13e1
- SHA1 78529e67ac1d3cde77de6fe7fb5d99471f02e388
- SHA512 aa6353888924157cec5bac5357591b9e6d344c8a89c032e97bcf1f230a76b90ae758993be2bfc2ca6d929ab2cb708389647e7dd2d6e9afc844675a1d7a042107
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext