General
-
Target
payment advice_008900112.exe
-
Size
246KB
-
Sample
220127-p5sgnsdcg9
-
MD5
0783312f7caf72f1ac2a9951145bdda4
-
SHA1
c3da5594f78880bd4fc1d496efca357e6c19f65a
-
SHA256
e745235386d1908e2bf40be43cf982932ce8b1604fe59ed2195aee341becb7c3
-
SHA512
1270782a3aa83186265d8253781d0af5aa5769ccff033672c4f42d27f1be73e7cd2dbe9adbd448a3c09841285c54523fd682721724564794ce152ffbde38d0e1
Static task
static1
Behavioral task
behavioral1
Sample
payment advice_008900112.exe
Resource
win7-en-20211208
Malware Config
Extracted
xloader
2.5
cxep
estateglobal.info
loransstore.com
loginofy.com
fjallravenz.online
cefseguranca-app.com
safontadiestramiento.com
bubbleteapro.com
morethanmummies.com
serviciopersonalizadoweb.com
headerbidder.info
skworkforce.com
heightsorthodontics.com
chulavistapd.com
southjerseyautobody.net
chargedbygratitude.com
meltingpotspot.com
gdjiachen.com
luckdrawprogram.com
vintagepaseo.com
bequestslojyh.xyz
layeredrofbes.xyz
com-weekly.email
suddisaddu.com
jnlord.com
outerverse.ventures
terraroyale.com
hairclub.info
rent2owninusa.com
pmaonline.xyz
wearecampo.com
multiplezonesplit.com
angry-mandala.com
ikigaiofficial.store
princewoodwork.store
moviesaver24.com
btec-solutions.com
valurgrayenterprises.com
homesofsilverspur.com
leysy-y-nazareno.com
grade8.tech
ammarus.com
researchjournal.net
nicolaslacasse.com
khukhuantainha.com
resultlv.com
toraportal.com
wickedhunterworld.com
clickspromolp.com
b148tlrnd09ustnnaku2721.com
high-low-ga.info
norcalfirewoodllc.com
fatima2021.com
aaronsmathquest.com
decal-mania.com
spitfiredefenceindustries.com
mireyita.com
simonhaidomous.com
roofingcontractorhickory.com
mgav69.xyz
spacebymeghan.com
hot144.com
mmfirewood.net
akshayaasri.com
bilgisayarimnekadar.com
littlesportsacademy.com
Targets
-
-
Target
payment advice_008900112.exe
-
Size
246KB
-
MD5
0783312f7caf72f1ac2a9951145bdda4
-
SHA1
c3da5594f78880bd4fc1d496efca357e6c19f65a
-
SHA256
e745235386d1908e2bf40be43cf982932ce8b1604fe59ed2195aee341becb7c3
-
SHA512
1270782a3aa83186265d8253781d0af5aa5769ccff033672c4f42d27f1be73e7cd2dbe9adbd448a3c09841285c54523fd682721724564794ce152ffbde38d0e1
-
Xloader Payload
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-