General
-
Target
FACTURA PENDIENTES_1.rar
-
Size
336KB
-
Sample
220127-necg4abhg7
-
MD5
72d6a92bbe674a4badc88888070fc1e7
-
SHA1
5c8aeb8bc0d2e53dbfdf166e043e3b7a230d8abb
-
SHA256
2480a6f5c3b3089ff7289258669122f644a8e6b5fc363daefe63cc49413c82fb
-
SHA512
e1add9d5f022c505a98f38867ea12b5fc58e6ce719153c8f1ea969f85db8dae35d85a8639d8e8122d08f4913281a94c0fc2765677062898565cd2dd2f6b3e3ab
Static task
static1
Behavioral task
behavioral1
Sample
GV8EJooYMIgEnEk.exe
Resource
win7-en-20211208
Malware Config
Extracted
xloader
2.5
cbgo
tablescaperendezvous4two.net
abktransportllc.net
roseevision.com
skategrindingwheels.com
robux-generator-free.xyz
yacusi.com
mgav35.xyz
paravocecommerce.com
venkatramanrm.com
freakyhamster.com
jenaashoponline.com
dmozlisting.com
lorrainekclark.store
handyman-prime.com
thecrashingbrains.com
ukpms.com
livingstonemines.com
papeisonline.com
chrisbakerpr.com
omnipets.store
anatox-lab.fr
missingthered.com
himalaya-nepalorganic.com
bitcoin-bot.xyz
velarusbet78.com
redesignyourpain.com
alonetogetherentertainment.com
sandywalling.com
solacegolf.com
charlottesbestroofcompany.com
stefanybeauty.com
webarate.com
experiencedlawfirms.com
lyfygthj.com
monoicstudios.com
rgamming.com
mintique.pro
totalwinerewards.com
praelatusproducts.com
daniloff.pro
qmir.digital
tatasteell.com
casatowerofficial.com
sunrisespaandbodywork.com
mgav66.xyz
bastnbt.com
fabiulaezeca.com
sunmountainautomotive.com
madgeniustalk.com
elite-hc.com
billcurdmusic.net
foxclothings.com
adtcmrac.com
buresdx.com
tothelaundry.com
bitconga.com
onlinebiyoloji.online
up-trend.store
kaarlehto.com
interview.online
grantgroupproperties.com
jpmhomes.net
yinlimine.xyz
roadtrippings.com
cottoneworld.com
Targets
-
-
Target
GV8EJooYMIgEnEk.exe
-
Size
382KB
-
MD5
cf6d4fd3dc8e4751b7f89f857b618ef3
-
SHA1
15b95f0f1b5785bb7fd3d97757f3eea49d1f6951
-
SHA256
9689e8e0cf51b8b5c98ddb007636d8acf7e03c9cc8a7bf99aafdaaebae2dfb3a
-
SHA512
86af327caf1d55c8d3dd1e2319dcae1faaf7db82fb2fdce83999b0a4e5c6af2ce700fb0c69f568169110f04b9af6543e069aee59101370d6af060d8d4763d43f
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-