General
-
Target
Invoice267782.xls
-
Size
254KB
-
Sample
210203-yqqxsyd68j
-
MD5
7e15415b138af90c8388aa309276ef7e
-
SHA1
23aba1aaf9d35894333fe29c86f76a236f602bdd
-
SHA256
5fdb1b3df88e49123804cb3cbdfee96b1e29371ca7ac6f27e3c57228a563aa10
-
SHA512
a275f4292dde13441d9dab4bd48b1acd9e88f7b1fbabd55dd33bced1f085d9b6d1b79121edda8fb99f8ae05d184d3e94940d14a4da6156094ead4620a1e12ea6
Behavioral task
behavioral1
Sample
Invoice267782.xls
Resource
win7v20201028
Malware Config
Extracted
https://nongsanxanhsach.com/licenser.txt
Extracted
buer
webgraitupeople.com
Targets
-
-
Target
Invoice267782.xls
-
Size
254KB
-
MD5
7e15415b138af90c8388aa309276ef7e
-
SHA1
23aba1aaf9d35894333fe29c86f76a236f602bdd
-
SHA256
5fdb1b3df88e49123804cb3cbdfee96b1e29371ca7ac6f27e3c57228a563aa10
-
SHA512
a275f4292dde13441d9dab4bd48b1acd9e88f7b1fbabd55dd33bced1f085d9b6d1b79121edda8fb99f8ae05d184d3e94940d14a4da6156094ead4620a1e12ea6
-
Buer Loader
Detects Buer loader in memory or disk.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-