General
-
Target
QT190682062.js
-
Size
866KB
-
Sample
220314-md9krsecb6
-
MD5
1a57814ee69545a677531e30491458f6
-
SHA1
2e4339114802ceb6f34077dfe27a39b4dfe2e595
-
SHA256
d808f56ae1df3f713475eeffac403cec3bc405e90c5aac6bda3209b87d2a7345
-
SHA512
6d96dbde544b60f44514f5f362a08fccd5469255fb9bc66c5b05dc0851987934d83482c2fbd6026193e49e93a6c76d48e004592bcd9fb9a28c889b706d408eb9
Static task
static1
Behavioral task
behavioral1
Sample
QT190682062.js
Resource
win7-20220310-en
Malware Config
Extracted
xloader
2.5
qatv
sexycurvycool.com
webundefinedstaging.website
gaspeehaze.com
adomnaturals.com
best10canadianreviews.info
nikekogan.com
5537sbishop.info
khonnaisoi.com
cures8t.com
garthoaks.com
belvederepharmagroup.com
chivo.plus
qishanlin.top
ccjon1.com
biz-financeagency.com
bdqimeng88.top
3-little-pigs.com
ord13route.art
webku-trial.xyz
ncgf28.xyz
nickatwoodrealestate.com
123piezas.com
woodju.com
afmview.com
travessiacursos.com
shreerragroindustries.com
lilacw.com
travelingbrunchbesties.com
cityloot.net
healthspecialist.info
kaliseastrand.com
jecoman.com
ystmo.com
lifecoach.directory
callahaninsurancegroup.com
commercialglassreplacement.com
webesluts.com
h5aolyhh6.com
drgcatherine.com
ronas.top
thevoilagroup.com
diemcrypto.tools
invest68.com
eleinmsa.xyz
sddn3.xyz
7dakka.online
endesasoluciounica.com
authenticinvesments.com
texasjusticelawyers.com
canada-settlement.com
outlook-admins.com
primarywatch.com
kaboomslots.email
innoattic.com
upstreetbarbershop.com
trulyproofreading.com
calciumsignaling.com
13977999.com
sheriffindiana.biz
uncorrectly.com
jjyymh.com
worldpasspassport.com
yjwnktaz.com
royalknightent.store
swachharepolymix.com
Targets
-
-
Target
QT190682062.js
-
Size
866KB
-
MD5
1a57814ee69545a677531e30491458f6
-
SHA1
2e4339114802ceb6f34077dfe27a39b4dfe2e595
-
SHA256
d808f56ae1df3f713475eeffac403cec3bc405e90c5aac6bda3209b87d2a7345
-
SHA512
6d96dbde544b60f44514f5f362a08fccd5469255fb9bc66c5b05dc0851987934d83482c2fbd6026193e49e93a6c76d48e004592bcd9fb9a28c889b706d408eb9
-
Xloader Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-