General
-
Target
don.exe
-
Size
207KB
-
Sample
210503-vj4ktrq3ss
-
MD5
6ca72f0ceaf0d1f582856ceeff594c1d
-
SHA1
c174f3350fb589beea7759eade0f5be0d7959d2c
-
SHA256
7e9997ea452090062e0512decd987ccd4ad16cc04d8bea777a4c8929b5ba85aa
-
SHA512
3018288f3125203a8d71b20a962ec672e3b256b4ce30b85dbe155e81355570d1803e72b10c2a8c1f0a34a984eb1ec1adfd7db5a2ca873a654564ae654f9e700f
Static task
static1
Behavioral task
behavioral1
Sample
don.exe
Resource
win7v20210410
Malware Config
Extracted
xloader
2.3
http://www.montcoimmigrationlawyer.com/uoe8/
chalance.design
certifiedlaywernj.com
bsbgraphic.com
caeka.com
zagorafinancial.com
cvingenieriacivil.net
mojilifenoosa.com
bucktheherd.net
sparkmonic.com
catherineandwilson.com
cdefenders.com
intersp.net
santoriniimpressivetours.net
arkansaspaymentrelief.com
tewab.com
bjzjgjg.com
michgoliki.com
oallahplease.com
plaisterpress.com
redyroblx.com
funnyfootballmugs.com
borderlesstrade.info
partequity.net
3992199.com
bestcoloncleanseblog.com
online-legalservices.com
fibermover.com
magen-tracks.xyz
hotelsinshirdimkm.com
beachjunction.com
lanren.plus
nouvellecartebancaire.com
thegiftsofdepression.com
metabol.parts
dvxdkrbll.icu
flsprayer.com
przyczepy.net
cantinhosdeaparecida.com
californiasecuritycamera.com
nevadasmallbusinessattorney.com
skipperdaily.com
missjeschickt.com
rocketmortgageshady.net
upholsteredwineracks.com
best20singles.com
fsquanyi.com
ronlinebiz.com
gaelmobilecarwash.com
commercials.pro
bl927.com
workforceuae.com
innercritictypes.com
unipacksexpress.com
chaitanya99.com
rangamaty.com
7chd.com
keydefi.com
liveporn.wiki
carajedellcasting.com
gooddoggymedia.com
boldercoolware.com
hispekdiamond.com
expnashvilletn.com
swashbug.com
Targets
-
-
Target
don.exe
-
Size
207KB
-
MD5
6ca72f0ceaf0d1f582856ceeff594c1d
-
SHA1
c174f3350fb589beea7759eade0f5be0d7959d2c
-
SHA256
7e9997ea452090062e0512decd987ccd4ad16cc04d8bea777a4c8929b5ba85aa
-
SHA512
3018288f3125203a8d71b20a962ec672e3b256b4ce30b85dbe155e81355570d1803e72b10c2a8c1f0a34a984eb1ec1adfd7db5a2ca873a654564ae654f9e700f
-
Xloader Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-