General
-
Target
023ba631fbbb8e83ea5708c0111878bd
-
Size
737KB
-
Sample
231229-yjr4fsefbn
-
MD5
023ba631fbbb8e83ea5708c0111878bd
-
SHA1
8bd5af6c31d22850ac23e5ae25a6c42242de621d
-
SHA256
842bbd8cf641e4fc48ddd749cd539ae90660432d9f6b5530dddfaf9bff80acd8
-
SHA512
cc581e371d6b0868bb745ff47a7c68c953ccc89759a795a405181fda62e2300ac9371ecf5890bdadbd126438b541cd3634cb4fc0b5587ee2d2f14f6996cf0d55
-
SSDEEP
6144:qwa0m/tnCZ4SZGD/Ck0f+Zro5760fTdAGDDmsqcirPV1lsFbWZoGm:qOj41N0fqre75djMcWPHqtGm
Static task
static1
Behavioral task
behavioral1
Sample
023ba631fbbb8e83ea5708c0111878bd.exe
Resource
win7-20231215-en
Malware Config
Extracted
xloader
2.3
ars4
hostelenot.com
jetsetazre.com
bargomobilityxyz.xyz
the3witches.com
thebirdsongagency.com
028jindanzi.com
cormacknnl.com
keithshugart.com
soyholistica.net
xmasmobivrbuy.com
thetithinglife.com
alternativemetalsupply.com
onnotin.net
azadifoundation.com
rustycrutches.com
seamarck.com
blvcktricity.com
xn--80aaxuhtg.network
meatcointernational.com
indorebodybilaspur.com
karmicaccounts.com
startpoxavida.club
organictrooper.com
ridgefundscu.com
bardiniluxury.com
iquarto.space
theumbrellafederation.com
machinegeology.com
visualsbyaahuti.com
szqblbj.com
cleanmasterpty.com
hosseinian-tradeco.com
fundacion-arca.com
excel-dse.com
xn--888-hkl4a5oycc8jsde.com
feriavirtualdelibros.com
protv360.com
service-trust35112.xyz
offgridhomeplans.com
direitodotrabalhador.com
ztfse.com
pizzalayka.xyz
tiabmao.com
rebelbelly.com
budsmasterhamilton.com
kaizencouture.com
instalcomfort.net
surtitit.website
jimmysudscharity.com
genesiser.com
top-dex2.com
vaynganhanglaisuatthap.com
coploniallife.com
konijiwah.com
nigeriannativeoutfits.com
apfinity.com
001385.com
eliteamazement.com
vaynhanhthienson.com
trinkparca.com
utang.net
gadgetloby.com
ecoconsciousart.com
shirtsswimwearcanada.com
marllysonick.com
Targets
-
-
Target
023ba631fbbb8e83ea5708c0111878bd
-
Size
737KB
-
MD5
023ba631fbbb8e83ea5708c0111878bd
-
SHA1
8bd5af6c31d22850ac23e5ae25a6c42242de621d
-
SHA256
842bbd8cf641e4fc48ddd749cd539ae90660432d9f6b5530dddfaf9bff80acd8
-
SHA512
cc581e371d6b0868bb745ff47a7c68c953ccc89759a795a405181fda62e2300ac9371ecf5890bdadbd126438b541cd3634cb4fc0b5587ee2d2f14f6996cf0d55
-
SSDEEP
6144:qwa0m/tnCZ4SZGD/Ck0f+Zro5760fTdAGDDmsqcirPV1lsFbWZoGm:qOj41N0fqre75djMcWPHqtGm
-
Xloader payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-