General
-
Target
LETTER OF INTENT.exe
-
Size
750KB
-
Sample
220218-spnekacfd6
-
MD5
b3f43a58149d9058f8c39455869c2f84
-
SHA1
8f3d20b2f71e7331c355e2926a5fc5ce71e72eb8
-
SHA256
a04a4acf00f50f8b3c3bea38914813aa75ce4ba8c30c08971a6094c492d0d41d
-
SHA512
4aa74fa83551e3c2318f488cf2dbd0741e9b42899ad8501c0bf9d0e2c6471fee6ad0c1588ea652195de1ef813e51bc2bb03628cf5609792e7e59e1baa56b3fef
Static task
static1
Behavioral task
behavioral1
Sample
LETTER OF INTENT.exe
Resource
win7-en-20211208
Malware Config
Extracted
xloader
2.5
uar3
jogoreviravolta.com
keysine.com
sami60.com
morganators.com
referral.directory
campdiscount.info
vanwah.com
jmtmjz.com
der-transformationscode.com
evangelvalormedia.com
bedsidehomecare.com
novaair.net
privilegetroissecurity.com
elsiepupz.com
yy77kk.com
nt-renewable.com
alyaqoutalabyadhautoparts.com
start-play-now.com
myskew.com
himalaya-finance.com
purwojati.com
freedomteaminc.com
byaliciafryearson.com
robocats.xyz
eumjugamu.net
bestofverona.guide
aeropatrol.net
nikisankala.com
klassociates.info
centroimprenta.xyz
xn--pckwb0cye6947ajzku8opzi.com
wasserstoff-station.net
finpro.tech
hydrocheats.com
theapplewatchdoctor.com
awridahmed.com
barrcoplumbingsupply.com
nbhard.com
32342240.xyz
photo.fail
rebornmkt.com
gzfs158.com
db-propertygroup.com
krpano.pro
globalsovereignbank.com
moonshot.properties
adanary.com
collegesecurityroadshow.net
ddsadvocacia.com
seo-python.com
5gjpu.xyz
riskprotek.com
luckbim.com
theperfecttrainer.com
taxyragl.website
ban-click.com
mystore.guide
katchybugonsale.com
chinadqwx.com
e-scooters.frl
hentainftxxx.com
52zf.icu
dbhong.com
escortworks.xyz
czzhudi.com
Targets
-
-
Target
LETTER OF INTENT.exe
-
Size
750KB
-
MD5
b3f43a58149d9058f8c39455869c2f84
-
SHA1
8f3d20b2f71e7331c355e2926a5fc5ce71e72eb8
-
SHA256
a04a4acf00f50f8b3c3bea38914813aa75ce4ba8c30c08971a6094c492d0d41d
-
SHA512
4aa74fa83551e3c2318f488cf2dbd0741e9b42899ad8501c0bf9d0e2c6471fee6ad0c1588ea652195de1ef813e51bc2bb03628cf5609792e7e59e1baa56b3fef
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-