General
-
Target
PINM0004334567.exe
-
Size
61KB
-
Sample
220831-jj9aeabaej
-
MD5
91a4021e289a152474fcc8e4a4ccccff
-
SHA1
ac02a26791571871d2e3f1d855d48d3c5025cbdb
-
SHA256
0c766eeb9fc5218d11643873f73ee5e5226fecb6c8571cbb373abf4e696d9026
-
SHA512
0c3282f79136ac4678a3f070f727bb4fa564a238fd4fa6f2435791c175d77950294cb6a2999e2d0a4d290b2cfe52736a60e2273532f8c6f30bbd5f13abbec646
-
SSDEEP
1536:HU23X9NKwuDUaQl+kzdC9GiZQWSwi/fUpS/fX/MNp:HUWQwuis1Jy///f/MT
Static task
static1
Behavioral task
behavioral1
Sample
PINM0004334567.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PINM0004334567.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
xloader
2.9
zzun
JnNtRHyNupy0GqRzAcasu7hb4rc=
Qv593NGLE7p9UNSaVkPXljAJm2QCNnc=
ePArIFWvjkkMgVEVhw4M4Jk=
26rqUwJ7dD0AiDI=
pBAxMHeK741QFw==
kHD7TPt5846pUMTX
56UnjFjHL1i0j659h3LymRnHpQj+SshC
4vKlKHflPqmWXRbrRwfPtrhb4rc=
6LBd4qButFAi
phMzGll8Ue7Fu+inq5cdnPaSugG3
NKswiQGCvZoG5FgsdHEI
rtTHnuUY8M1qVcXV
SOmECrlAt2oGAA==
L1ep9adutFAi
/UE+/AyvE6uEl28weFI=
IP+xMPQxJR4NE6TK
xvW5GN9/rqA5YUoOVt185Sf7Uw==
fRFNW9DhxL6VF7LA
KFYTfkaY741QFw==
W4JGvMBmt2oGAA==
lnoad0Hkgrwl9uXlghvqdz33UA==
1msShiu+9wisELGDjYAK
FBXFOinAK8ylnMZzi35Okw==
V8Y7/cBnt2oGAA==
VfuI0k5pSmi6+aNjIlAT2mspCZBZLGA=
de74yg89D61bSiU=
V2UPjYUvwh21qdxUr4Mf
DcFXvTxFMlyfL5JJIU0=
GldbH/CCt2oGAA==
sxdEIBwn+o+pUMTX
UmViK+1/Knr8814sdHEI
jrfKoZ6paLyeEBETgw4M4Jk=
SR27MizpGwCa19Kb1A==
2DGo9XUNxBOe19Kb1A==
7tBn2cG8jasWHE7w559Aig==
8qtAoVHxl/KGerbsfA4M4Jk=
fC3AH6Utt2oGAA==
HltlPHZ7FpSpUMTX
xd0B+Pr30gBfQGYXafOW1dOSflv+SshC
DKXWyiOecY7319Kb1A==
Pvx505EaswiHYF3z559Aig==
aJ6kaz7CWKsP9g9Ur4Mf
qcvfxb9TwUoDCrfXw/uTdSkTCJBZLGA=
I++iH8xJxFp73nyUjJOg3/PS/3W7
K1N1guwbLz0AiDI=
vp2SfavTmBXNzLeXmIoUhsB7
UlAVhgIfLT0AiDI=
6BKH5GjHt2YIo/qhA69S+5E=
6U29K+qVw5hT4gQ83A==
G9NTmhwpAwY6r4I69kT4dz33UA==
0qstoaNBmBrMlfwTKhrAtLhb4rc=
ZvMhGW52cyAAXkVV3Jc96Lhb4rc=
N9Z3/PmEt2oGAA==
ohlOhcaP741QFw==
9WF3PohVjEolhCY=
am0ek4wtmkEI9GMVhw4M4Jk=
ROotH4+jhp7vnzVdww==
uvkuFhGmJlyjpFFpi35Okw==
ICHQQTIjaxTryG8weFI=
AhIZ8uh974+pUMTX
pEBtSFHr/5s0GQ==
qAcuLnqLNeOpUMTX
bcHv6WdbHoWEylgsdHEI
Nz/rbWh3s4WFDL9uPlAhXKNz
secure-id6793-chase.com
Targets
-
-
Target
PINM0004334567.exe
-
Size
61KB
-
MD5
91a4021e289a152474fcc8e4a4ccccff
-
SHA1
ac02a26791571871d2e3f1d855d48d3c5025cbdb
-
SHA256
0c766eeb9fc5218d11643873f73ee5e5226fecb6c8571cbb373abf4e696d9026
-
SHA512
0c3282f79136ac4678a3f070f727bb4fa564a238fd4fa6f2435791c175d77950294cb6a2999e2d0a4d290b2cfe52736a60e2273532f8c6f30bbd5f13abbec646
-
SSDEEP
1536:HU23X9NKwuDUaQl+kzdC9GiZQWSwi/fUpS/fX/MNp:HUWQwuis1Jy///f/MT
Score10/10-
Xloader payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-