General
- Target Invoice.exe
- Size 613KB
- Sample220426-e662cabaa2
- SHA256 c0e6b0b4e80d36f0872fe01ed20cc5a6d17083f6d11ff93cc5ccc841dd43aa33
- MD5 703bd7292224b5d00585ec252a902076
- SHA1 145e2da551cb35c772d2fb9e4faa8d840c3866c9
- SHA512 86888c8e04711359b5ffdb37714613e673fdf48c0527a40c735f92289c9fd600357dcd543481b3cb98b9d761a59ea60bf7cc3951a9241586686e78ef1e09e0ae
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Invoice.exe
Resource
win7-20220414-en
Malware Config
Extracted
-
xloader
-
2.5
-
gfge
-
loopcoalition.com
-
hd126.com
-
elioguion.net
-
defitrader.academy
-
exactemi.com
-
angeloacierno.com
-
range4tis.com
-
ilovekuduro.us
-
mydealsstation.com
-
jerichoprinting.com
-
birdcafe605.com
-
freemansrepublic.com
-
driedplasma.com
-
valuableconnect.com
-
anthonyvid.xyz
-
theydo.support
-
devnetsecops.com
-
cryptork.tech
-
ufheur678.store
-
lavenderspa586.com
-
scandicinvestmentholding.com
-
youenfangtex.com
-
gratefulgrandmas.com
-
ampersandtalent.net
-
wippychick.com
-
stamping.digital
-
trixes.net
-
popinticket.com
-
ivyleaguereading.com
-
killerinktnpasumo3.xyz
-
greatyuwx.com
-
royaltortoisecookieco.online
-
quinten-and-sam.com
-
mobile-sh.com
-
reacjs.com
-
hongbufang.net
-
winemenuimports.com
-
nashuatelegrpah.com
-
nicorgaa.com
-
outlanfd.com
-
personalitideal.com
-
mhhj666.com
-
themethodcollective.com
-
36536a.com
-
bijit.xyz
-
yoursinsoccer.net
-
cryptoducks.club
-
defuw.com
-
kangley.net
-
hacvm.com
-
zhouyihong.top
-
takut5.com
-
kreditnekarticers.com
-
koigo-wp.com
-
52byhx.com
-
phaghpanah.com
-
apqlds.com
-
karxsba2ix.xyz
-
demasinfimo.quest
-
unitytrstbnk.com
-
panasonic-hcm.com
-
27530amethystway.com
-
idealftz.xyz
-
conventionline.com
-
gulabmonga.com
Targets
-
- Target Invoice.exe
- Size 613KB
- SHA256 c0e6b0b4e80d36f0872fe01ed20cc5a6d17083f6d11ff93cc5ccc841dd43aa33
- MD5 703bd7292224b5d00585ec252a902076
- SHA1 145e2da551cb35c772d2fb9e4faa8d840c3866c9
- SHA512 86888c8e04711359b5ffdb37714613e673fdf48c0527a40c735f92289c9fd600357dcd543481b3cb98b9d761a59ea60bf7cc3951a9241586686e78ef1e09e0ae
- MD5 SHA1 SHA512
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext