General
-
Target
68239a914c97e9fab8025768cff809ac841076a39963a5416810ad9c697ae2d5
-
Size
1.2MB
-
Sample
220131-vz8vcsadaq
-
MD5
210281ba8584eef02754bb15a9c83d36
-
SHA1
4603f1cd443feaece6e5167b0c2f6a0486aa73b6
-
SHA256
68239a914c97e9fab8025768cff809ac841076a39963a5416810ad9c697ae2d5
-
SHA512
b4c3466d87f56c2a0954a7d4b47a430babffe9dba4dfbbd5f6837b299164e2a74775db975ae822a7013c3358f7abd7321afc6bbc63a57edb07a33316afeda3b8
Static task
static1
Behavioral task
behavioral1
Sample
XXXXXXXX.exe
Resource
win7-en-20211208
Malware Config
Extracted
xloader
2.3
mabs
joiderqm.com
hyc306.com
ouchplus.asia
abrosnm3.com
hospitalanti-infectives.com
ala-co.com
morrisonltts.net
tradingimpulse.com
invisibleimagination.com
jdjshop.com
huntedby.com
szsgfdzx.com
germfightersusaiowa.com
pahaadpost.com
obrankers.com
plaeralum.com
getfitwithmeministry.com
smartswaploan.com
gypsyjewelrydesigns.com
meetgoodwill.info
lojadoalfinete.store
santacruzcountytogether.com
exonmobilerewardsplua.com
secretthaichalmette.com
muy-a.com
convertanalysis.com
pepperqueenfarm.com
starlabgroup.design
thejuwongs.com
originesakai.com
contabilidadeemgeral.online
mwal.art
petnaturally.net
wbhomerenovations.com
tugarabato.com
ireapills.com
massagethe615gmail.com
thebarksuperdeals.com
phillyvotefromhome.net
altamar-usa.com
profilesofgrace.com
tpc-365.com
thoughtsintheskyy.com
coloringpagesadults.net
offerionn.com
dyfaanfamily.com
epdcs.com
farag.design
investirenelmondo.com
breakingq.com
laughing-flower.com
la-bel.photography
rhymingspeeches.com
whatisastaxanthin.com
ethicalllykate.com
qiqi-commerce.com
bakalskaing.com
honeywoodsauces.com
opengatefoods.com
armandplatter.com
themetrosupermarket.com
sbsc-program.com
pcreonline.com
discountmetalart.com
heehan.com
Targets
-
-
Target
XXXXXXXX.EXE
-
Size
228KB
-
MD5
3f79af5c415898c279c6d5f76e8dd710
-
SHA1
6d633461533eca9413ef699b7e68d245261a88c9
-
SHA256
10a451fc1e7687549d6e116dd5ff984f3468de4dcc6e1494ed16c6c501668eb6
-
SHA512
d6fb55e05ab09f5aee47a51764db246c9d0d4762fe006479c437b7536f14dce14d58213ccf87cab5ab61c419b1520e4631bae7bf9860609fbe8945e782ccb9e4
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Sets service image path in registry
-
Deletes itself
-
Suspicious use of SetThreadContext
-