General
-
Target
36ca5751b0b2d9321215f223a18aefbf.exe
-
Size
324KB
-
Sample
211103-ydek6sefe5
-
MD5
36ca5751b0b2d9321215f223a18aefbf
-
SHA1
c9661ff48f2eaa2718a46b23a70a02a8461715be
-
SHA256
602c4326ca0aa0a007b10241d7dae3fdbef7705e14231ba85e8635578cfdb0d4
-
SHA512
f698c83167eda1832e90eeed65d39883b6515c0f6c718e3ce6d517e6d230bab14b15a920f90979a2cf55c601688819deec0de2b47278a032103a22fd2fe2774c
Static task
static1
Behavioral task
behavioral1
Sample
36ca5751b0b2d9321215f223a18aefbf.exe
Resource
win7-en-20211014
Malware Config
Extracted
xloader
2.5
ga6b
http://www.egyptian-museum.com/ga6b/
diasporacospices.com
sd-shenghe.com
onlinewritingjobs.net
greenstreamgroup.store
garageair.agency
idh-bf.com
middenhavendambreskens.com
szkoleniawcag.online
wiremefeelings.com
ottosperformance.com
brothermush.com
weiserpath.com
baohiemtv24h.com
glassgalaxynft.com
spiritualmind.space
18130072012.com
3v0.space
smartgadgetscompare.com
corvusexpeditii.xyz
egcontabilidade.website
find0utnowfy.info
soulwinningministry.com
digitaldreamcloud.net
service-portal-kundendaten.com
theselectdifference.com
burodev.com
mustafacesuryildiz.com
grupodeinvestigacion.com
toyotadisurabaya.com
partnerbenifits.com
belledescontos.com
nobodybutgod.com
bumiths.com
acacave.com
septoctets.xyz
www73w.xyz
afghantattoos.com
interiorsbe.com
ara7z.com
qqcx666888.top
onra.top
sunfucker.net
suhuabo.com
tangerineinit.com
era636.com
lovenft.xyz
maviesurdvd.com
gullatz-consulting.com
duopasteleras.com
mystudentregistration.com
5559913.win
gritzcharlestonluxuryinn.store
themexicanbg.com
senshop.store
woodentoysforkids.store
globalgamelan.com
anjumanmuhibaneabbas.com
seattleinsurancebrokers.com
naiduteja049.info
traction.legal
twisteid.com
necesryaou.com
apan-group.com
infinityrope.store
Targets
-
-
Target
36ca5751b0b2d9321215f223a18aefbf.exe
-
Size
324KB
-
MD5
36ca5751b0b2d9321215f223a18aefbf
-
SHA1
c9661ff48f2eaa2718a46b23a70a02a8461715be
-
SHA256
602c4326ca0aa0a007b10241d7dae3fdbef7705e14231ba85e8635578cfdb0d4
-
SHA512
f698c83167eda1832e90eeed65d39883b6515c0f6c718e3ce6d517e6d230bab14b15a920f90979a2cf55c601688819deec0de2b47278a032103a22fd2fe2774c
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Xloader Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-