General
- Target Order sheet 31082021.exe
- Size 728KB
- Sample210831-j5ysf8stee
- SHA256 1b4d3e69b4e2e533522d48f27a0137e34b92b01e36d348c12f0df4371ed7d573
- MD5 9e856fa0646392a26030e9b6c3c537c2
- SHA1 081b85d8be2c8fd004407e20c7d5c0e2fcf0dd8f
- SHA512 9581170fe85e7dfe4921ddb0f9a46a7a46f43265f7534a5db383d05fffd57d79252ad77ea2670ecbfe510b701b8caad021997d6fd523caff40be59226f3d1ffe
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Order sheet 31082021.exe
Resource
win7v20210408
Malware Config
Extracted
-
xloader
-
2.3
-
p4se
-
http://www.appackersandmoversbengaluru.com/p4se/
-
weightlossforprofessionals.com
-
talkotstopandshop.com
-
everesttechsolutions.com
-
garboarts.com
-
esubastas-online.com
-
electriclastmile.com
-
tomio.tech
-
jacoty.com
-
knot-tied-up.com
-
energychoicesim.com
-
rocketcompaniessham.com
-
madarasapattinam.com
-
promosplace.com
-
newstarchurch.com
-
thesaleskitchen.com
-
slingmodeinc.com
-
jobresulthub.com
-
pillclk.com
-
shipu119.com
-
sibalcar.com
-
quotovate.com
-
bluecoyotecontracting.com
-
hc68kr.com
-
laundry39.com
-
vietthaivt.com
-
ikonflorida.com
-
xn--sm2b97e.com
-
innovisional.co.uk
-
spacecityscouples.com
-
slmccallum.com
-
hro41.com
-
theyardcardzstore.com
-
primewildlife.com
-
xn--seranderturzm-ebc.com
-
stilesandhansen.com
-
bvlesty.com
-
hejiayin.com
-
philosophersdojo.com
-
aworldofsofas.com
-
itile.net
-
unitronicdealers.com
-
savasoguz.com
-
magetu.info
-
devgmor.com
-
villasabai.com
-
pipipenguin.com
-
furnishessentials.com
-
patchmonitoring.com
-
michaelhumphriesrealestate.com
-
pratikahealth.com
-
caswellcu.com
-
lakeportal.com
-
weedyourmind.com
-
cardamommm.com
-
freshstartrestorationllcmd.com
-
mastercardbhdleon.com
-
ceramiccottageco.com
-
magiczneszkielka.com
-
casebookconnet.com
-
recharge.directory
-
phoneprivacyscreen.com
-
mumbaindicator.com
-
jumboprovacy.com
-
streamerdojo.com
Targets
-
- Target Order sheet 31082021.exe
- Size 728KB
- SHA256 1b4d3e69b4e2e533522d48f27a0137e34b92b01e36d348c12f0df4371ed7d573
- MD5 9e856fa0646392a26030e9b6c3c537c2
- SHA1 081b85d8be2c8fd004407e20c7d5c0e2fcf0dd8f
- SHA512 9581170fe85e7dfe4921ddb0f9a46a7a46f43265f7534a5db383d05fffd57d79252ad77ea2670ecbfe510b701b8caad021997d6fd523caff40be59226f3d1ffe
- MD5 SHA1 SHA512
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext