General
- Target VrzbgLW535gNZH4.exe
- Size 599KB
- Sample210703-k8rm22txcs
- SHA256 dd759c0f396781dd67e9b31cbb725e88883defe4d10698606ca9f50e1a92ffb2
- MD5 8584dabe4ec50b1bdfbf339dc48dbc9b
- SHA1 c010efe50dc57c8070003644682d925be85dbfdc
- SHA512 13e33e7c0074d26b2f68d156fcf5b247bacb1727f58537e8ecefb3827490d909cbfbd037b7a00280902a1cfae0fc24c01aff31731b026b570986eaec5456a407
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
VrzbgLW535gNZH4.exe
Resource
win7v20210410
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.kkkwhitepride.com/66op/
-
ttxyzp.com
-
miamivendingservices.com
-
namanhphat.com
-
filmexllc.com
-
snowflakebytes.net
-
qygdance.com
-
small-mart.online
-
libryapp.com
-
guadelouperegistry.net
-
hoodiessport.com
-
tienda-china.com
-
musicergonomy.com
-
yahonatinog.space
-
lvn.xyz
-
aerospace-engineers.com
-
bluemountainbeveragecompany.com
-
thedonationcard.com
-
gigharborcancercare.com
-
restondefencejobs.com
-
alfenafootwear.com
-
351215.com
-
cloudlmis.com
-
nowprepared.net
-
fossa.network
-
westlandphotographer.com
-
chihvacassociation.net
-
magictrick-s.com
-
police-baton.com
-
notaria12.net
-
mortonwine.com
-
cottonordinary.guru
-
halloweenfunshoppe.com
-
saadinuts.com
-
naomieducates.com
-
universalmailinvoting.com
-
volkras.com
-
laganacheconfections.com
-
fullmoonrestlessco.com
-
dnhsxm.com
-
silkway777.com
-
e-lohas.info
-
misstenazas.com
-
aplikasihotel.com
-
desirexpress.com
-
returpen.net
-
contrastblogger.com
-
wttfiber.com
-
finoblog.com
-
engraved-plate.com
-
mimik33.info
-
dolphinresinsandpaints.com
-
4getmoreplandata.com
-
unemmploymentpua.com
-
onixtours.com
-
healebear.com
-
mauritiushackathon.com
-
kyowaunyu-recruit.com
-
northstarinterface.com
-
startersattorney.info
-
tailgatorstruckshop.com
-
neutralogics.com
-
xn--se-zia.com
-
gcuea.com
-
opencollective.digital
Targets
-
- Target VrzbgLW535gNZH4.exe
- Size 599KB
- SHA256 dd759c0f396781dd67e9b31cbb725e88883defe4d10698606ca9f50e1a92ffb2
- MD5 8584dabe4ec50b1bdfbf339dc48dbc9b
- SHA1 c010efe50dc57c8070003644682d925be85dbfdc
- SHA512 13e33e7c0074d26b2f68d156fcf5b247bacb1727f58537e8ecefb3827490d909cbfbd037b7a00280902a1cfae0fc24c01aff31731b026b570986eaec5456a407
- MD5 SHA1 SHA512
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext