General
-
Target
TT Slip $24,000.rar
-
Size
235KB
-
Sample
220129-kceynaggg4
-
MD5
fe9f56ee5a424b53161d4d29c1f10931
-
SHA1
809864bca989673afd82ad91b8ada5000f2046ed
-
SHA256
2664cc5138f3019f2c8d19395dad4d4778457da5ee222bca4fc11b62a10e442f
-
SHA512
37185e8f9ab83f6a642d2d52e8144de368f566fe9a5ffa5b34eb069027af861f375c3047209bcc6197e5fe806d9d0b733e23d0e8439aa5ac0a16a396b1473daa
Static task
static1
Behavioral task
behavioral1
Sample
HIRE SOA FOR DEC_2021.exe
Resource
win7-en-20211208
Malware Config
Extracted
xloader
2.5
cxep
estateglobal.info
loransstore.com
loginofy.com
fjallravenz.online
cefseguranca-app.com
safontadiestramiento.com
bubbleteapro.com
morethanmummies.com
serviciopersonalizadoweb.com
headerbidder.info
skworkforce.com
heightsorthodontics.com
chulavistapd.com
southjerseyautobody.net
chargedbygratitude.com
meltingpotspot.com
gdjiachen.com
luckdrawprogram.com
vintagepaseo.com
bequestslojyh.xyz
layeredrofbes.xyz
com-weekly.email
suddisaddu.com
jnlord.com
outerverse.ventures
terraroyale.com
hairclub.info
rent2owninusa.com
pmaonline.xyz
wearecampo.com
multiplezonesplit.com
angry-mandala.com
ikigaiofficial.store
princewoodwork.store
moviesaver24.com
btec-solutions.com
valurgrayenterprises.com
homesofsilverspur.com
leysy-y-nazareno.com
grade8.tech
ammarus.com
researchjournal.net
nicolaslacasse.com
khukhuantainha.com
resultlv.com
toraportal.com
wickedhunterworld.com
clickspromolp.com
b148tlrnd09ustnnaku2721.com
high-low-ga.info
norcalfirewoodllc.com
fatima2021.com
aaronsmathquest.com
decal-mania.com
spitfiredefenceindustries.com
mireyita.com
simonhaidomous.com
roofingcontractorhickory.com
mgav69.xyz
spacebymeghan.com
hot144.com
mmfirewood.net
akshayaasri.com
bilgisayarimnekadar.com
littlesportsacademy.com
Targets
-
-
Target
HIRE SOA FOR DEC_2021.exe
-
Size
247KB
-
MD5
d8af2363d5a46336733b6121c0b4cf0e
-
SHA1
fcb0ee44436230d924b2550fc9935ee76f2498fe
-
SHA256
2a4415721925c12ce8a80719697ffbda5daf88fe34804b0549bc5d5605790cdb
-
SHA512
e34f724dc4a7837ff86ed5d5214e1ed22e5643bbd45f881066b05b4ae4766a6330a48db8e4ef8dcee9ca8bf5ace43d987a667f62ea086992d2ff1ee24875889d
-
Xloader Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-