General
-
Target
SecuriteInfo.com.Suspicious.Win32.Save.a.19722.3011
-
Size
510KB
-
Sample
220620-2fcfdaebh4
-
MD5
ba748857809258b6284b8808b5970362
-
SHA1
b79ba291dccb372c28611e80985b3d88ffd2664d
-
SHA256
049f9e87ced5e64d948562a171161d2a807f90f35337261bebdce170e78ea5ff
-
SHA512
95ec5e6903f4a0c72b3ca1ef6ae081c85fdaa0267b28c6b3ad8c2f09946592949c4d91701914a9b8468fab218538ab7ccf240b458f0f9b8e656d2d59d9c8a57b
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Suspicious.Win32.Save.a.19722.exe
Resource
win7-20220414-en
Malware Config
Extracted
xloader
2.6
nyx
sairithanyaclinic.com
taskifyapp.com
153at132.com
jeyutech.com
linkalternatifqq.xyz
cameralensesko.com
hanel-industries.com
thelebanesemafia.net
luxurymask.xyz
atenkv.com
brockenhalle.com
yhysvgj.site
panabacus.com
tdesoc.com
a-specto.com
chignon.xyz
345ere.com
250soceanblvd.com
immuneee.xyz
celineprivateresidencies.com
wervont.com
ecosarmoya.com
mychoicee.com
zoomslut.com
notespaid.com
heartless.top
jbpipesupply.com
theimmersiontour.com
madamepassionkids.com
dshlrf.com
fortuna-shipping.com
gadebnica.quest
tcwenchang.com
tcthirdcredit.com
9gtshoes.com
dllcnx321.xyz
yitengpc.com
apesweb.xyz
globalworldco.com
logisticalcorp.com
rdpcrackyhead.com
karayollu.xyz
gzjxbt.com
retrowoods.net
magnolia.services
chriaraferragnibrand.com
tigersconstructionllc.com
desoc9.com
broadcastluis.com
sisibukbahe.com
fod-financien-be.com
alphundbrand.com
vipstar-164.website
calcs.cool
angarsoul.online
leadsoft.email
alplaytherapy.com
covenoccultwares.com
jordinacroft.com
odaxel.com
posthelpline.com
delegatustareas.com
eparolumbs.com
okplatform.life
samundricargo.com
Targets
-
-
Target
SecuriteInfo.com.Suspicious.Win32.Save.a.19722.3011
-
Size
510KB
-
MD5
ba748857809258b6284b8808b5970362
-
SHA1
b79ba291dccb372c28611e80985b3d88ffd2664d
-
SHA256
049f9e87ced5e64d948562a171161d2a807f90f35337261bebdce170e78ea5ff
-
SHA512
95ec5e6903f4a0c72b3ca1ef6ae081c85fdaa0267b28c6b3ad8c2f09946592949c4d91701914a9b8468fab218538ab7ccf240b458f0f9b8e656d2d59d9c8a57b
-
Xloader Payload
-
Suspicious use of SetThreadContext
-