General
-
Target
628faeeb6947bb6c169a95026d62826e
-
Size
518KB
-
Sample
240117-nyplrsfbg5
-
MD5
628faeeb6947bb6c169a95026d62826e
-
SHA1
b30dee07345f79718b537d96ad4b8d450c26c980
-
SHA256
7da12f9f66e5a7ee4f9a6a025c6c3a1464ea85d0d805d2f7e85537c24a4ad6c0
-
SHA512
fc8e6a5b6352cd02061c526975a8c35b71596eeebd23779fd448dd2cdb10a2dcc9616e74451c64f95a63aa825bbb135ef80a27ac6ace804df69da83f5f5771e5
-
SSDEEP
12288:szhoi6+4T615AgbPza8yZ2o/Ke4FqmFlxLVLIFb8z1:/i6O1KIzaR2o/Ke4EiLWM1
Static task
static1
Behavioral task
behavioral1
Sample
628faeeb6947bb6c169a95026d62826e.exe
Resource
win7-20231215-en
Malware Config
Extracted
xloader
2.3
b6cu
votreconseilfinancier.com
wholesaleplay.com
komfy.store
hsyunfan.com
tournamenttips.com
yourbusine.xyz
wrg-referrals.com
harmless-oily.com
whizdomtowealth.com
xusmods.com
cleanerstoday.com
finopscert.com
paerexpress.com
kankb.com
res-o.info
balonpantolon.com
freedownloadbiz.info
jeffegriffin.com
gobahis119.com
ourcalvinsarm.com
jvbgroups.com
umsio.com
byritcn.com
darunfanzhi.com
hwshen.com
lifelooker.bid
1xbetmart8.online
aleitzeventdecor.com
realxxxx.com
jellenllc.com
attalaschools.com
thestripcitydeli.com
dynamite-tacos.com
styleandsoulshift.com
mamafacil.com
de-handyman.com
amazon-accountserviceapp.com
funfactshub.com
luminancevivant.com
magemutfak.com
alwaysbuyused.com
autentiskommunikation.one
marrakechdesignartisanal.com
blun33.com
ericalife.com
escuelaiztapalapavd.com
lockalock.com
dollaroneshop.com
xn--pckxbp6bzgv915dgbf.website
treasureecomllc.com
tiantianhanju.com
gotothishygienist.com
peamon.net
9westholdings.com
casinovulkan.bid
dmdrafttech.com
brixtonpattycompany.com
stop-masquerade.com
webuyepa.com
influencersden.com
mgm2348543.com
subusastry.com
bharathub.net
africanmusiccharts.com
xn--marketingrevolucin-61b.com
Targets
-
-
Target
628faeeb6947bb6c169a95026d62826e
-
Size
518KB
-
MD5
628faeeb6947bb6c169a95026d62826e
-
SHA1
b30dee07345f79718b537d96ad4b8d450c26c980
-
SHA256
7da12f9f66e5a7ee4f9a6a025c6c3a1464ea85d0d805d2f7e85537c24a4ad6c0
-
SHA512
fc8e6a5b6352cd02061c526975a8c35b71596eeebd23779fd448dd2cdb10a2dcc9616e74451c64f95a63aa825bbb135ef80a27ac6ace804df69da83f5f5771e5
-
SSDEEP
12288:szhoi6+4T615AgbPza8yZ2o/Ke4FqmFlxLVLIFb8z1:/i6O1KIzaR2o/Ke4EiLWM1
-
Xloader payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-