General
-
Target
8c2d96ab_by_Libranalysis
-
Size
205KB
-
Sample
210506-lk3shgaqej
-
MD5
8c2d96abda99516a36f04f6a504bf79e
-
SHA1
b2e6c392636248c2705ac3a23a6fafbc8e5c1897
-
SHA256
a0b018fb2193eec4f61de14d4d60b1cae8ba46b2cabfc704d59ac6d134dbf4e5
-
SHA512
f1223ff5e2c800b049600264a6fa69293dc7c404697a506da7cfa29e1977b8ce97860c164b46e9840d89dba69defafa9930b7af76e0a6617691bf5bc1e4e3144
Static task
static1
Behavioral task
behavioral1
Sample
8c2d96ab_by_Libranalysis.exe
Resource
win7v20210410
Malware Config
Extracted
xloader
2.3
http://www.onyxcomputing.com/u8nw/
constructionjadams.com
organicwellnessfarm.com
beautiful.tours
medvows.com
foxparanormal.com
fsmxmc.com
graniterealestategroup.net
qgi1.com
astrologicsolutions.com
rafbar.com
bastiontools.net
emotist.com
stacyleets.com
bloodtypealpha.com
healtybenenfitsplus.com
vavadadoa3.com
chefbenhk.com
dotgz.com
xn--z4qm188e645c.com
ethyi.com
farrellforcouncil.com
everythingcornea.com
pensje.net
haichuanxin.com
codeproper.com
beautyblvdca.com
namastecarrier.com
xtrator.com
alphabrainbalancing.com
sensationalcleaningservices.net
magistv.info
shotsbynox.com
zioninfosystems.net
yourstoryplace.com
ebmulla.com
turkeyvisa-government.com
albertsonsolutions.com
7brochasmagicas.com
revolutiontourselsalvador.com
eastboundanddowntrucking.com
jkskylights.com
ultimatepoolwater.com
diurr.com
investmentfocused.com
dogscanstay.com
inov8digital.com
paragoncraftevents.com
reservesunbeds.com
melaniesalascosmetics.com
vissito.com
axolc-upoc.xyz
customessayjojo.com
kladki.com
online-securegov.com
xn--demirelik-u3a.com
plgmap.com
contorig2.com
dgyzgs8.com
valuedmind.com
sanacolitademarijuana.com
xn--6j1bs50berk.com
labkitsforstudents.com
lifehakershagirl.online
candidanddevout.com
Targets
-
-
Target
8c2d96ab_by_Libranalysis
-
Size
205KB
-
MD5
8c2d96abda99516a36f04f6a504bf79e
-
SHA1
b2e6c392636248c2705ac3a23a6fafbc8e5c1897
-
SHA256
a0b018fb2193eec4f61de14d4d60b1cae8ba46b2cabfc704d59ac6d134dbf4e5
-
SHA512
f1223ff5e2c800b049600264a6fa69293dc7c404697a506da7cfa29e1977b8ce97860c164b46e9840d89dba69defafa9930b7af76e0a6617691bf5bc1e4e3144
-
Xloader Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-