General
-
Target
products order pdf.exe
-
Size
825KB
-
Sample
210331-vy85ck4swn
-
MD5
78b638ad61109b9327e9a3a304bf1fac
-
SHA1
d4abee4c7936c2a797c44d4cd579f62de172b216
-
SHA256
1cfec89b2bfbcdd400f0cd58741a2d7a218bb2bbf2399b55833c6f4a64829883
-
SHA512
fb415828b9b5db340a7b277319305b3f574a7e435e4238ab16b619dbfd812543d63b1439711863338b73160da461d8fc5a5dd20dd615d2e8a06e57e7d997dc7b
Static task
static1
Behavioral task
behavioral1
Sample
products order pdf.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
products order pdf.exe
Resource
win10v20201028
Malware Config
Extracted
xloader
http://www.brandonprattdrums.com/nt8e/
cfwg123.com
gazipasadan.xyz
careogeen.com
zitatewelten.com
thecvpro.com
viltais.com
benimed.today
rogerecameron.com
courtclassesathome.com
yakin-hm.com
vidasanayprospera.com
mandirana.com
skybluebet.com
rescuedpetsarewonderful.com
solisdq.info
affiliateside.com
homewellliving.com
missteenroyaluniverse.com
bajrangproperties.com
bundleobliss.com
donotwasteyourvote.com
shuziyuming.com
sabalotours.com
awesomebikeco.com
katysteakhouse.com
journeyofcamera.com
electricmotorcyclecollector.com
hincodrones.com
rfscustominteriors.com
agilelocker.com
jobheap.com
vrolin.com
tudeladirecto.com
tqwhspace.com
ricoemail.com
highfashionexchange.com
simplicty-in-life.com
3907allendale.com
mostposh.com
poshzip.com
mohdnaved.com
lostintraveland.com
elitephoneskillsacademy.com
coastalconciergebyliz.com
enbranding.com
tibetanartacademy.com
intothenest.com
andygreenphd.com
whereistheherb.store
thehimawaribrand.com
wapdevs.com
sewadorbsclothing.com
citestaccnt1598677757.com
radiosteel.com
cover-solutions.com
feeneylaminate.com
minnesotawake.com
eneralysis.com
gomashio-taste.com
neutralplasmaexchange.com
liancaiwangv1.com
jobonlineupdate.com
runforlunch.com
fux.xyz
Targets
-
-
Target
products order pdf.exe
-
Size
825KB
-
MD5
78b638ad61109b9327e9a3a304bf1fac
-
SHA1
d4abee4c7936c2a797c44d4cd579f62de172b216
-
SHA256
1cfec89b2bfbcdd400f0cd58741a2d7a218bb2bbf2399b55833c6f4a64829883
-
SHA512
fb415828b9b5db340a7b277319305b3f574a7e435e4238ab16b619dbfd812543d63b1439711863338b73160da461d8fc5a5dd20dd615d2e8a06e57e7d997dc7b
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Xloader Payload
-
Adds policy Run key to start application
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-