General
- Target MACHINE SPECIFICATION.exe
- Size 141KB
- Sample210322-dsytqpfncx
- SHA256 fd32e6bad3561c5fe9dcb7cc9429fb110fea37c843753f33f453b18df751520e
- MD5 b0a9731f9bbba99a908362d88de6151e
- SHA1 5b3bfae3291a00bf6a9296dd027ccae6f404cf64
- SHA512 3f043af094dc4c2ab62a81e86ba48af53b7f4f86fde13ae62b78455fd05b354ef59d693e65d67086ad418a6edbbd85a4292b27712560e948170d22566ddf3678
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
MACHINE SPECIFICATION.exe
Resource
win7v20201028
Malware Config
Extracted
-
xloader
-
http://www.dubainights.net/rrrq/
-
sdlcutps.com
-
novieffendi.com
-
highpointedu.com
-
sagaming.today
-
charlottesteer.com
-
kilopapa.net
-
prime-executive.com
-
8893270.com
-
gorillaikka.com
-
coynesgastropub.com
-
sun9376.xyz
-
coolkilo.com
-
1clickdoc.online
-
fosa.info
-
smileburgerdelivery.com
-
ronpaulmessge17.com
-
sqwigs.com
-
xn--c1ajbkdnb9b0g.xn--p1acf
-
gelzers.info
-
banpluspay.com
-
chemluan.com
-
vehcimbev.com
-
voyageesthetique.com
-
gurmishpainting.com
-
egofickle.com
-
klikhoster.net
-
chainlinkbulls.com
-
6987599.com
-
curtex.info
-
dogcollarcartoons.com
-
videomediaaid.online
-
qoyal.com
-
girloliver.com
-
indoorcannabisproducer.com
-
josefloreslive.com
-
pomtpu.com
-
gwalletcc.com
-
lapsteelator.com
-
vitalyst.digital
-
teleworkstar.info
-
kansas-chiefs.com
-
ingeniousmkt.com
-
whowealth.com
-
mycfhp.com
-
st-plumbing.com
-
listsouth.com
-
citestaccnt1598618655.com
-
x-tech.design
-
carmellastore.com
-
petalpetal.net
-
myworldporn.com
-
crgxdz.com
-
ladronesdepalabras.com
-
becomestateman.com
-
thebigmessages.com
-
novak-versand.com
-
melekhemfuzaylovrealtor.com
-
deeanaespinosa.com
-
cachpay.com
-
beyond-luxury-villas.com
-
qrrnwdev.icu
-
revolutionofwork.com
-
whatsonpk.com
-
solidaritybrother.com
Targets
-
- Target MACHINE SPECIFICATION.exe
- Size 141KB
- SHA256 fd32e6bad3561c5fe9dcb7cc9429fb110fea37c843753f33f453b18df751520e
- MD5 b0a9731f9bbba99a908362d88de6151e
- SHA1 5b3bfae3291a00bf6a9296dd027ccae6f404cf64
- SHA512 3f043af094dc4c2ab62a81e86ba48af53b7f4f86fde13ae62b78455fd05b354ef59d693e65d67086ad418a6edbbd85a4292b27712560e948170d22566ddf3678
- MD5 SHA1 SHA512
-
Xloader Payload
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext