General
- Target SOA-1236-1132220.exe
- Size 511KB
- Sample220113-njajashfg9
- SHA256 459c86bf11535b9d62c895a6677a5eb40d8f0cf3136477e5da746045bf3fb6a3
- MD5 a875f7f3c4919ab73dfe1aa861c064cc
- SHA1 9ab650e1331edbadc803b46d5f6089f4d42bbd6f
- SHA512 a10dcf5fd5c2e9850fbc1e0fc0ea76f6833a35290d3d012f6fded0df219ce24b566137a03a785c50209b6222e00c11a18fd73ec71ad1e6695b25a9ad39640ad7
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
SOA-1236-1132220.exe
Resource
win7-en-20211208
Malware Config
Extracted
-
xloader
-
2.5
-
eb4c
-
rasmkv.com
-
klhb1000.com
-
usales.agency
-
x4g7ae8.com
-
englishtutors.store
-
coffeegirlstuff.com
-
vpb-haiphong.com
-
noonesown.com
-
totallyglamplans.com
-
hlthtec.com
-
sculpturehairandfashion.com
-
jewelsjoule.com
-
ref-30001-p.com
-
brairazur.xyz
-
lilithsag.com
-
degengains.com
-
5d-crypto.com
-
sanfeca.com
-
wonderfulsunny.com
-
syntheticloot.net
-
azmibishara.info
-
mgav77.xyz
-
cuddleboo.com
-
dbsexoticsusa.com
-
wadsworthre.net
-
scs-bau.com
-
kcckurla.com
-
funtabse.com
-
craftncloud.com
-
sddn28.xyz
-
ninospetcare.com
-
travelday1.xyz
-
mrsmortgageexpert.com
-
5402506.win
-
nckp12.xyz
-
cayyoluescort.xyz
-
ta6655.com
-
juvesti.com
-
shop-nilo.com
-
qldfancyfencing.com
-
mywiggle.net
-
sto227.com
-
anyflooring.net
-
sueldatersy.quest
-
mayandhari.com
-
happyyuk.xyz
-
support-amazon.fr
-
lisa-oekaki.com
-
emberdirect.com
-
aretinian.top
-
southerncharmdrinks.net
-
epiqshoes.com
-
kayhardy.com
-
atsym.com
-
howtofindpeopleforfree.com
-
i0quyvam3.xyz
-
kusogkabataan.com
-
against-violence.com
-
metroprocesservers.com
-
fairy-aroma.com
-
thecollectivelabs.net
-
rishi.solar
-
jessicapedrowedding.com
-
pokeuniteth.com
-
orenvend.store
Targets
-
- Target SOA-1236-1132220.exe
- Size 511KB
- SHA256 459c86bf11535b9d62c895a6677a5eb40d8f0cf3136477e5da746045bf3fb6a3
- MD5 a875f7f3c4919ab73dfe1aa861c064cc
- SHA1 9ab650e1331edbadc803b46d5f6089f4d42bbd6f
- SHA512 a10dcf5fd5c2e9850fbc1e0fc0ea76f6833a35290d3d012f6fded0df219ce24b566137a03a785c50209b6222e00c11a18fd73ec71ad1e6695b25a9ad39640ad7
- MD5 SHA1 SHA512
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext