General
-
Target
PO-003785GMHN.exe
-
Size
985KB
-
Sample
210927-txj8jshecq
-
MD5
4577c41fc896a87df4513f13d29ee65a
-
SHA1
38e76942a779e8b04cdf763cf993ceda76d049f2
-
SHA256
144fc8c1a922dbb8162d72a94780f8559bbd9e6b1faa9e037fd33e809126b080
-
SHA512
dbd15ae87202593f80daf6563bd7ef8bb9be154c7c1995ca6c127c7bfa8e8fb1eb5d9c075d887ef8a893fa64ddb72402e11da3c7f57aeda276ee4fc3c50f21af
Static task
static1
Behavioral task
behavioral1
Sample
PO-003785GMHN.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
PO-003785GMHN.exe
Resource
win10-en-20210920
Malware Config
Extracted
xloader
2.5
8iwd
http://www.serpascarnes.com/8iwd/
openhousedigitale.com
helpindia.store
josiahspicer.com
wydancer.com
athinatoday.com
asiapartnerspoint.com
freemakechefsrecipes.com
metrolistingsservices.com
assarytagged.quest
ververevival.com
cjdue.com
iqmetaverse.com
sh-spgdk.com
spacecitybeauty.com
phasmatoidea.com
yz1866.com
tenlog009.xyz
gameprizes.xyz
415know.com
virus-jestock.com
fmsgmbh.com
chinaglobalawarenesscodeday.com
sekailuxe.com
luvjoyproperties.com
amandlaparaffin.com
dreamcenterabq.com
finestpoints.com
lbbed.com
teamgamecocks.club
fallscreation.com
365gy.net
vtprealtor.com
emailassure.com
yogiler.com
ss2196.com
csntow.com
lechotamalamona.com
kingdomofdavid.kiwi
ismaella.com
facebooking.club
adelinesgrill.com
uzh.biz
vivimendes.com
throwpillowco.com
honestwealthbuilding.com
inoutinsurance.xyz
iqvisory.com
mkbau-quickborn.com
sellbesty.com
south1995officiel.com
austrahe.com
trancendentalastroshop.store
gotcookies.net
meglutenfree.com
clayexoticsatl.com
tonerventes.com
torresflooringdecorllc.com
mentication.com
formula-evolution.com
likethespirit.com
reddysinfotech.com
laketappsapartment.com
yimailg.com
0kscp.com
Targets
-
-
Target
PO-003785GMHN.exe
-
Size
985KB
-
MD5
4577c41fc896a87df4513f13d29ee65a
-
SHA1
38e76942a779e8b04cdf763cf993ceda76d049f2
-
SHA256
144fc8c1a922dbb8162d72a94780f8559bbd9e6b1faa9e037fd33e809126b080
-
SHA512
dbd15ae87202593f80daf6563bd7ef8bb9be154c7c1995ca6c127c7bfa8e8fb1eb5d9c075d887ef8a893fa64ddb72402e11da3c7f57aeda276ee4fc3c50f21af
Score10/10-
Xloader Payload
-
Adds Run key to start application
-