General
-
Target
vbc.exe
-
Size
761KB
-
Sample
210923-lpswqaeae5
-
MD5
1c3047465bb31dd2ac45101680301992
-
SHA1
36219c9148dafb036bc5871c440cbcf959d1b683
-
SHA256
995c349e77a02cf1d77af852797437f2cd89914f41f493fa7f352549f374d7d3
-
SHA512
cc4ef5a89b34067434e478a8e9d96e212dc1cdb0b8c128d7ab6890e91cb4c4f0170270b86ae872219c4adfbe1bcb19490beadbe65ae4f296aabc9b802ed93d74
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-en-20210920
Malware Config
Extracted
xloader
2.5
arup
http://www.sapphiretype.com/arup/
mezonpezon.com
bellapbd.com
xn--2kr800ab2z.group
cupecoysuites.com
extractselect.com
cherrycooky.com
reshawna.com
bluewinetours.com
dez2fly.com
washedproductions.com
om-asahi-kasei-jp.com
talkingpoint.tours
avaspacecompany.com
fbtvmall.com
trocaoferta.com
mionegozio.com
reitschuetz.com
basepicks.com
networkagricity.com
kastore.club
groovydeer.com
realisa.net
891708.com
naveenachittibiyina.com
guizhouawj.com
royaltortoisecookieco.online
scubafarm.com
sibo.care
rapi-vet.com
metaid.website
shadoworksart.com
gratitudegalore.com
penhal.com
fetch-an-us-itchy.zone
melisaakyolicmimarlik.com
yiweise.com
sofasstorremolinos.com
rfanil.com
metaverselemon.com
theholidaymovieplanner.com
n4sins.com
fortcor.com
galaxysingle.com
gzwqpsyj.com
azur-riviera-rental.com
bharathpaperbagmachine.com
pinup722bk.com
darkness.global
theihearthotel.com
wecowork.net
big-thoughtconsulting.com
ricartepinlac.com
beatsingh.com
xn--e6qg25lq0kdudqy7g.com
zkingstore.com
gd83574.com
jiajssie.xyz
patientempowered.care
tiannuoxxrp.top
itsnalab.com
ioumal.com
bellinghamapartment.com
sakibotchi.com
jessicapets.com
Targets
-
-
Target
vbc.exe
-
Size
761KB
-
MD5
1c3047465bb31dd2ac45101680301992
-
SHA1
36219c9148dafb036bc5871c440cbcf959d1b683
-
SHA256
995c349e77a02cf1d77af852797437f2cd89914f41f493fa7f352549f374d7d3
-
SHA512
cc4ef5a89b34067434e478a8e9d96e212dc1cdb0b8c128d7ab6890e91cb4c4f0170270b86ae872219c4adfbe1bcb19490beadbe65ae4f296aabc9b802ed93d74
-
Xloader Payload
-
Deletes itself
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-