General
-
Target
46d25e193b0fa8c66294eae90d6ba0a0
-
Size
597KB
-
Sample
240106-v98mcaecd5
-
MD5
46d25e193b0fa8c66294eae90d6ba0a0
-
SHA1
ba916e712b87e72613ec43255eb1f4031f034e87
-
SHA256
8211def9e38f6488cc96851d5c572b9607e3dca6e33bd375ca99435f964ef94c
-
SHA512
2c9037ea177abaf139ff69e410b2c452220b841045509a2a996ddcc14a83725f23fd733c8a1d4dc527698b5565ceedaaedfcda9ea0f62139cc59a199fadc8fe3
-
SSDEEP
12288:WrIpdkwHs7NSC7idzgtXQkZ7PRR/SgSwHwg9s:W0LkwHspSZgp5b/SgSwHf9s
Static task
static1
Behavioral task
behavioral1
Sample
SLB SOA format.exe
Resource
win7-20231215-en
Malware Config
Extracted
xloader
2.3
n8ba
thefitflect.com
anytourist.com
blggz.xyz
ascope.club
obyeboss.com
braun-mathematik.online
mtsnurulislamsby.com
jwpropertiestn.com
animalds.com
cunerier.com
sillysocklife.com
shopliyonamaaghin.net
theredcymbalsco.com
lostbikeproject.com
ryggoqlmga.club
realestatetriggers.com
luvlauricephotography.com
cheesehome.cloud
5fashionfix.net
wata-6-rwem.net
ominvestment.net
rrinuwsq643do2.xyz
teamtacozzzz.com
newjerseyreosales.com
theresahovo.com
wowmovies.today
77k6tgikpbs39.net
americagoldenwheels.com
digitaladbasket.com
gcagame.com
arielatkins.net
2020coaches.com
effthisshit.com
nycabl.com
fbvanminh.com
lovebirdsgifts.com
anxietyxpill.com
recaptcha-lnc.com
aprendelspr.com
expatinsur.com
backtothesimplethings.com
pcf-it.services
wintonplaceoh.com
designermotherhood.com
naamt.com
lifestylebykendra.com
thehighstatusemporium.com
oneninelacrosse.com
mariasmoworldwide.com
kitesurf-piraten.net
atelierbond.com
mynjelderlaw.com
moucopia.com
hauhome.club
imroundtable.com
thralink.com
baoequities.com
nassy.cloud
goldenstatelabradoodles.com
revenueremedyintensive.com
dfendglobal.com
pugliaandgastronomy.com
cypios.net
trinioware.com
narrowpathwc.com
Targets
-
-
Target
SLB SOA format.exe
-
Size
822KB
-
MD5
de5656ea33859b231be8d245879fb101
-
SHA1
c95708277b7b4e34d9856ef6d181dfeef3640282
-
SHA256
0f91cd4c92db7272fae1a765da60d80d3ace80c956737f08d21f11676a0e2719
-
SHA512
4baec52fcc2335d8d3b74e59f3c9401e6efcb8f8e1bb9ff4e0a01f24d3a0f8d2f0dd1d104c770f6e6a4e68f9bee19303e8620f1e675f84f037a21d2ea7bfe92a
-
SSDEEP
12288:jRrxjDE7AUZxoR65AXwgFvuSSvIodboVRkqc4QYqFvY3uFPo1HwqhQIdK7/UGbQO:jRiDoR6qgRNSqqOBFgwwLR0UwMC7E
-
Xloader payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-