General
- Target IMG 29987 SHIPMENT Order 85 3.02.2022.exe
- Size 558KB
- Sample220203-rf5rtaabd9
- SHA256 af662c52d97d2590fa9a275d02feaf5aab3c18365e002a288efd862bd09aa6b4
- MD5 d541dd30d857710b9a5f708b83db0241
- SHA1 6a6b66e233eee0b11129732e35e4e7c65c631c84
- SHA512 685cdf9f95452ca8b177208cac7fc6841709167a5a46116d7267c6330fcf4f77ecca67dd9730554682bdc5fbf9e19f5f2f0bb3bb3ab2f520f49271261067ac89
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
IMG 29987 SHIPMENT Order 85 3.02.2022.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
IMG 29987 SHIPMENT Order 85 3.02.2022.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
-
xloader
-
2.5
-
p8ce
-
wishmeluck1.xyz
-
nawabumi.com
-
terra.fish
-
eoraipsumami.quest
-
awakeningyourid.com
-
csyein.com
-
tslsinteligentes.com
-
cataractusa.com
-
capitalwheelstogo.com
-
staffremotely.com
-
trashbinwasher.com
-
blaneyparkrendezvous.com
-
yolrt.com
-
northendtaproom.com
-
showgeini.com
-
b95206.com
-
almcpersonaltraining.com
-
lovabledoodleshome.com
-
woodlandstationcondos.com
-
nikahlive.com
-
sassholesentiments.com
-
bupis44.info
-
salahiheartclinic.com
-
loveandpersonality.com
-
electric-cortex.com
-
beijixing-zs.com
-
proper-sa.com
-
legacyfamilypartners.com
-
psidsamor.com
-
schotinderoos.com
-
kosma-concept.com
-
onitled.com
-
zscyyds.xyz
-
mannatgroups.com
-
radweb-demo.com
-
lambanghieuquangcao.info
-
antabatik.com
-
lerongclub.com
-
mobssvipshop.com
-
dr-walther.com
-
ibexitconsultants.com
-
cnyprospects.com
-
j9mkt64.com
-
archer-claims.com
-
lggrandinn.com
-
jowhp.com
-
outdoormz.store
-
cantikgroup.company
-
2brothersprinting.com
-
ginamodernart.com
-
koupeespen.quest
-
senerants.tech
-
designthrottle.com
-
emquality.com
-
cerulesafe.com
-
orascomservice.com
-
skinsotight.com
-
premiumconciergemarbella.com
-
cottagepor.xyz
-
gwayav.com
-
johnguidesyou.com
-
corporativokale.com
-
jskswj.com
-
xinico.info
-
gebaeudetechnik-burscheid.com
Targets
-
- Target IMG 29987 SHIPMENT Order 85 3.02.2022.exe
- Size 558KB
- SHA256 af662c52d97d2590fa9a275d02feaf5aab3c18365e002a288efd862bd09aa6b4
- MD5 d541dd30d857710b9a5f708b83db0241
- SHA1 6a6b66e233eee0b11129732e35e4e7c65c631c84
- SHA512 685cdf9f95452ca8b177208cac7fc6841709167a5a46116d7267c6330fcf4f77ecca67dd9730554682bdc5fbf9e19f5f2f0bb3bb3ab2f520f49271261067ac89
- MD5 SHA1 SHA512
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext