General
-
Target
Inquiry-URGENT.zip
-
Size
442KB
-
Sample
211002-dwwbesdef7
-
MD5
19b17876f701ae06ff22d8fa24790aa8
-
SHA1
20387eef3f68258589913d62a7b0b4ce01776247
-
SHA256
092556173667d99c032fc3698faa80242ddcc880b9854655c5f619355903c4ae
-
SHA512
96988712f4ca58920cb6892de467a8b7267572c346fd8efe5fca8d681f8deaef762eb1a63f0e63ebb261ae8a3e1a25113285666bb8674b0fb373c0d064ff2356
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry-URGENT.exe
Resource
win7v20210408
Malware Config
Extracted
xloader
2.5
b5ce
http://www.rheilea.com/b5ce/
advellerd.xyz
giasuvina.com
arab-xt-pro.com
ahsltu2ua4.com
trasportesemmanuel.com
kissimmeesoccercup.com
studyengland.com
m2volleyballclub.com
shyuehuan.com
elsml.com
blog-x-history.top
coditeu.com
allattachments.net
vigautruc.com
mentication.com
zambiaedu.xyz
filadelfiacenter.com
avlaborsourceinc.info
tameka-stewart.com
studio-cleo.com
cruisebookingsonlineukweb.com
bajajfinservmutualfund.com
bipxtech.cloud
glottogon.com
villamante.com
lvfrm.xyz
bhadanamedia.digital
austindemolitioncontractor.com
nutritionhawks.com
vcmalihx.top
busybstickerco.com
lianshangtron.com
tenncreative.com
charmfulland.com
zuridesire.com
vliegenmetplezier.com
khlopok.club
tovardarom.xyz
atmospheraglobal.com
lakeefctmich.com
novasaude-g1.online
joymort.com
allexceptionalcapital.com
balicoffeeuniversal.com
netjyjin26.net
arpdomestic.com
ozglobetips.online
zeogg.club
josiemaran-supernatural.com
sieuthinhapkhau.store
healthonline.store
coiincrypt.com
fofija.com
yshowmedia.com
enhancedcr.com
tous-des-cons.club
holeinthewallbus.com
okssl.net
gutenstocks.com
thelindleyfamily.com
apexpropertiesltd.com
powerhousetepusa.com
urbanopportunities.com
comarch.tech
Targets
-
-
Target
Inquiry-URGENT.exe
-
Size
617KB
-
MD5
7c347b3aba43cefc31e91fede356961b
-
SHA1
58bb9e282a8d6c95941d310a23010718901c58dd
-
SHA256
c18d5baf727358a8635a51fc7cfb4c3f4c90c78abcecf051feb4540323e98746
-
SHA512
94b6633784c888527aef5e3f4cba9d03b04118f43c0f6222b2c60e756fdb183fe88e9a9d940b95fb3ac2d85bee4a4a681ab8f77f4de85c9a722c8c8da9eaebe9
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-