General
- Target Order.exe
- Size 732KB
- Sample210610-smdfke7hee
- SHA256 73e5b50b261f0d3f8e31c4cd387f86be97b206b9a5cda3dfe0122618bce85151
- MD5 371836374bcbc5b1818ec38adb0fba57
- SHA1 cd7d3d450ad63245d813fec71eb424824ddc26f6
- SHA512 460fa8b04c400431f9323c0ae82241da7a8508a92b6b03e0edb02ded0ca6a23ded82be97af2914679e9098e2a354602886484ead2df4a88d0bcddf666935ebfb
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Order.exe
Resource
win7v20210410
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.generalplex.com/pz9b/
-
gochili.info
-
cyberdatadefence.com
-
payonbux.com
-
candiceswanepoelbrasil.com
-
mykaoa.com
-
tanabe-kanagu.com
-
dovetailgoodlife.xyz
-
alabasterautomotive.com
-
tajc.club
-
authwdqtsi6sojynof9gmazon.com
-
cookingguides.net
-
yah360.com
-
berriq.com
-
freetoreview.online
-
yachtsgoneonline.com
-
clothestokidsri.com
-
howtogetstartedwithfba.com
-
simplepartyplanning.com
-
sunrisekai.com
-
wealthfarmer.net
-
indumaqservicios.com
-
sanookna.com
-
stgg.net
-
resultrun.info
-
dynamismedical.com
-
katfacecosmetics.com
-
wjlzbc.com
-
madebymygypsysoul.com
-
belpair.net
-
aktamusic.com
-
generationathletic.fitness
-
artandscience.info
-
timbisoaps.com
-
foursonsltd.com
-
komitmenindonesiasejahtera.com
-
buildingbusinessonline.net
-
nativeiso.com
-
sagalocal.icu
-
deepcombine.com
-
conecationsystemss.net
-
airtech-engineers.com
-
rjccollectibles.com
-
haegrumfood.com
-
brunchtimes.com
-
beautifulbodyz.com
-
vidaifriend.com
-
blinbins.com
-
cvnsm2020.com
-
thompsonwebmanagement.com
-
xn--lichthlzer-jcb.com
-
tyrellsaintvil.com
-
charismaadvice.com
-
webshopfront.com
-
creativesoulsclubs.com
-
schul-service.com
-
maridaniellecontreras.com
-
thefreelancerzone.com
-
1000-help4.club
-
thecookiechicktx.com
-
mutschein.com
-
balveny.com
-
sorteesportiva.bet
-
adamsandfane.com
-
ashleyjordanoutlaws.com
Targets
-
- Target Order.exe
- Size 732KB
- SHA256 73e5b50b261f0d3f8e31c4cd387f86be97b206b9a5cda3dfe0122618bce85151
- MD5 371836374bcbc5b1818ec38adb0fba57
- SHA1 cd7d3d450ad63245d813fec71eb424824ddc26f6
- SHA512 460fa8b04c400431f9323c0ae82241da7a8508a92b6b03e0edb02ded0ca6a23ded82be97af2914679e9098e2a354602886484ead2df4a88d0bcddf666935ebfb
- MD5 SHA1 SHA512
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext