General
-
Target
48c9e4c8_extracted
-
Size
160KB
-
Sample
210304-4a9fjha83a
-
MD5
d1a9b9e29edfb6ddefa1fe00e9486f6e
-
SHA1
4f8484df9b6ef4b54fbd7ebd882e10a155bc87f2
-
SHA256
bc68f1c3e90d38b089534333bded35a4c736b1d18bce2b2fe151a46a53ca390d
-
SHA512
3e87c8b6cac73fc46387891bda1c58d5ba0d3bee26f8c66eecbe4af976c5b8bd9c6b5bc3898743ebd488bf930077d3f310ac606c6332e120914ebb454274c4a0
Behavioral task
behavioral1
Sample
48c9e4c8_extracted.exe
Resource
win7v20201028
Malware Config
Extracted
xloader
http://www.wekrazy.com/ianv/
toysclass.com
baohiemthuduc.com
dronesracers.com
wallis-platform.com
waltermorgan.fitness
vsn-designs.com
cengjing.life
trackcatologueorders.com
newworkpay.com
brainywoodindia.com
myrtlebeachstripperstoyou.com
saori.cloud
10fastvpn.com
freemindsweden.com
phatsquares.com
pandemia.tienda
7560eads6.com
sabjidada.com
zhyingj.group
nailmanicurest.com
makkoho.net
biaobazhongxin.com
wwwyourcardoctor.com
careless-customers2.com
greghickmanrealestate.com
testdomain0606.site
cantstealmyvote.com
binismailhealthcare.com
impact-holdingsgroup.com
plastic-girl.com
itcomputershn.com
racevx.xyz
jiangsuruiyou.com
tuding1688.com
kimloaig7.net
kannanconsulting.com
reconnecttogod.com
solverstv.com
therecover.computer
iamalittlesomething.com
rottendemocrats.com
triplayover.com
classonlinepy.com
magapatriotsdeals.com
casafacilpe.com
umasolarsupply.com
getinfloww.com
thecleanlifellc.com
knownyork.com
practicewithpersia.com
hervirtuouslife.com
goldjewelrybuyersplano.com
belleharlo.com
bundatrima.online
localvahomes.com
petreltradingchambers.com
jueligh.com
awadata.com
craftedcompulsion.com
dresiara.com
natsu-blog.net
nonbartv.com
greezymobbent.com
opelakcesoria.online
Targets
-
-
Target
48c9e4c8_extracted
-
Size
160KB
-
MD5
d1a9b9e29edfb6ddefa1fe00e9486f6e
-
SHA1
4f8484df9b6ef4b54fbd7ebd882e10a155bc87f2
-
SHA256
bc68f1c3e90d38b089534333bded35a4c736b1d18bce2b2fe151a46a53ca390d
-
SHA512
3e87c8b6cac73fc46387891bda1c58d5ba0d3bee26f8c66eecbe4af976c5b8bd9c6b5bc3898743ebd488bf930077d3f310ac606c6332e120914ebb454274c4a0
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-