General
-
Target
192.3.239.22_-_9000_-_rcu.exe___66ce150c7f9bc6a34864f1488b5fb358.dat
-
Size
1.5MB
-
Sample
220607-ktlsjaghaq
-
MD5
66ce150c7f9bc6a34864f1488b5fb358
-
SHA1
4062dc69dec7a4811197236059c633afbae4261c
-
SHA256
1475cdf12c2451eaacc8867526d7be4544d31d5a6a6dca03e28d4af9b941d517
-
SHA512
426afa919f9ee33d5e5c6d1e8b6c971c6b6d5374b701b89de5be30a4c2f1085744bdad08d7b81584fdef67722ec58ee83a48cf6e547eba5c5a6c9b0c7331a905
Static task
static1
Behavioral task
behavioral1
Sample
192.3.239.22_-_9000_-_rcu.exe___66ce150c7f9bc6a34864f1488b5fb358.exe
Resource
win7-20220414-en
Malware Config
Extracted
xloader
2.6
be4o
laboratoriobioixcha.com
tictocperushop.online
wild-oceans.com
belaruscountry.com
kicktmall.com
fitcoinweb.tech
mores.one
gogear.one
gxrcksy.com
samrcq.com
impossible-icecream.com
bravesxx.com
bookchainart.com
sleepsolutionsofmboro.com
ocbrazilbusinessclub.com
advisor76.xyz
xitaotech.com
mgsdtytifgf3414.xyz
johnson-brown.net
cr3drt.com
virtualtourpro.store
transporteriocristal.com
fjbingjiang.com
minecraftrojectx.site
ttrcb.com
sexlarab.com
cxzczc2.online
doorsmm.com
weisbergiegal.com
skythinks.com
schoolsuperaty.com
swampbucketkids.com
networklogicsa.com
businessevs.com
gulfcoastclinicchiro.com
milliards.xyz
moviesquery.com
cycletostack.com
c0wkvo.com
inkingthings.net
cookvillecampgroundvt.com
rajeshprinters.com
binge-bane.biz
ginger9632-voice.cloud
1nfo-post.com
unta.xyz
liuhumu.com
khandaia.info
ha01qnscvts0l.xyz
liert.site
allflowmedia.com
6ibnuj9t.xyz
embravewise.com
responsabilities.com
apexges.com
ola-speechtherapy.com
pristinefarmlands.com
adaraateristiayote.store
journeyhomemeditation.com
96238.top
nosipokip.site
itt-service.com
bw590jumpb.xyz
relieveyourdog.com
qiyeweiiliaoo0428.com
Targets
-
-
Target
192.3.239.22_-_9000_-_rcu.exe___66ce150c7f9bc6a34864f1488b5fb358.dat
-
Size
1.5MB
-
MD5
66ce150c7f9bc6a34864f1488b5fb358
-
SHA1
4062dc69dec7a4811197236059c633afbae4261c
-
SHA256
1475cdf12c2451eaacc8867526d7be4544d31d5a6a6dca03e28d4af9b941d517
-
SHA512
426afa919f9ee33d5e5c6d1e8b6c971c6b6d5374b701b89de5be30a4c2f1085744bdad08d7b81584fdef67722ec58ee83a48cf6e547eba5c5a6c9b0c7331a905
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Adds policy Run key to start application
-
Blocklisted process makes network request
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-