General
-
Target
REVISED ORDER.exe
-
Size
985KB
-
Sample
210506-lcj4rdx4p2
-
MD5
61f942cbb67b5a5de8f72dfe65227175
-
SHA1
45271b8b2797e1232efe813d9d34e9ca9c7564a4
-
SHA256
979a3e20b43d1aad57018b9c867e4bde7606d0515c9c71b2050b02c0b5e5fd10
-
SHA512
f6448602b457f455e3da9f8e2c30c5d0062ed81c10b420f180a6ba7b7c4fa5dd3eef4cfc95db68a476d27ee40bb6bb86a4a8b55b4fedea87ada32ba87ddb80f7
Static task
static1
Behavioral task
behavioral1
Sample
REVISED ORDER.exe
Resource
win7v20210410
Malware Config
Extracted
xloader
2.3
http://www.athomecp.com/owws/
trolljoke.com
contex3.info
jabashir51.com
brittand.com
djaya.asia
lab-wealth.com
greyfriararabians.com
oxfordhabits.com
softwaresreports.info
abjms.com
winsteadarchitecture.com
brucerolfsboulder.com
unitytribune.com
cyjulebu.com
abaplants.com
theexerciseforyou.com
codigodebarrasser.com
barbicanroadproductions.com
sportenango.com
hostsnc.com
clubdonovoka.com
adaptive.science
meeplesisters.com
shubhkari.com
pooliswaiting.com
sempat-ya8.com
davispackphotography.com
dezigo.design
faxbbs.com
lunarvac.com
thewerideveloper.com
ingenesinstitute.com
elizabethfulco.com
assemble-4u.com
jingcilian.com
rnpynsjw.net
raphainfosec.com
gdzas08.cloud
murrpurrs.net
hakua36tokyo.com
rakennuskolibri.net
renerossi.com
raphaelyejesiel.com
phoxinh.net
amrshadhartanah21.com
thehoneyglo.com
xn--mariachilen-zeb.com
excelfaq.online
expandetusingresos.com
cupsteam.com
your-new-body-plan.com
misskarenenglishreacher.com
pulkitkumar.wtf
tluxebeautyexperience.com
sissysundays.com
ketoburnerrevolution.com
babdestaffing.com
easywayplanet.com
rewealth.club
siamboss.com
shamansmoke.com
truervoice.com
denisekohli.com
gx17.net
Targets
-
-
Target
REVISED ORDER.exe
-
Size
985KB
-
MD5
61f942cbb67b5a5de8f72dfe65227175
-
SHA1
45271b8b2797e1232efe813d9d34e9ca9c7564a4
-
SHA256
979a3e20b43d1aad57018b9c867e4bde7606d0515c9c71b2050b02c0b5e5fd10
-
SHA512
f6448602b457f455e3da9f8e2c30c5d0062ed81c10b420f180a6ba7b7c4fa5dd3eef4cfc95db68a476d27ee40bb6bb86a4a8b55b4fedea87ada32ba87ddb80f7
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-