General
-
Target
product specification.xlsx
-
Size
1.4MB
-
Sample
210503-yl97jaeyxn
-
MD5
75c48b4392ae795beeb0317bfaef77bd
-
SHA1
8e3e8daaa18cb3cf0e3b73e90ecbd297c9d5e1ee
-
SHA256
4a5c10a7e9ec7b65f8605186726d4861c5bc96870204e12eb260ebd841e7aedb
-
SHA512
95480a723ab8360552a5d6820cd0ffd1371da2bc49d008620b1b7d034d49c2a6d69e2fd7b62af414f9260ee00f0c48bb8e045c1ca9f9d0de843a3e9b0b759366
Static task
static1
Behavioral task
behavioral1
Sample
product specification.xlsx
Resource
win7v20210410
Behavioral task
behavioral2
Sample
product specification.xlsx
Resource
win10v20210408
Malware Config
Extracted
xloader
2.3
http://www.montcoimmigrationlawyer.com/uoe8/
chalance.design
certifiedlaywernj.com
bsbgraphic.com
caeka.com
zagorafinancial.com
cvingenieriacivil.net
mojilifenoosa.com
bucktheherd.net
sparkmonic.com
catherineandwilson.com
cdefenders.com
intersp.net
santoriniimpressivetours.net
arkansaspaymentrelief.com
tewab.com
bjzjgjg.com
michgoliki.com
oallahplease.com
plaisterpress.com
redyroblx.com
funnyfootballmugs.com
borderlesstrade.info
partequity.net
3992199.com
bestcoloncleanseblog.com
online-legalservices.com
fibermover.com
magen-tracks.xyz
hotelsinshirdimkm.com
beachjunction.com
lanren.plus
nouvellecartebancaire.com
thegiftsofdepression.com
metabol.parts
dvxdkrbll.icu
flsprayer.com
przyczepy.net
cantinhosdeaparecida.com
californiasecuritycamera.com
nevadasmallbusinessattorney.com
skipperdaily.com
missjeschickt.com
rocketmortgageshady.net
upholsteredwineracks.com
best20singles.com
fsquanyi.com
ronlinebiz.com
gaelmobilecarwash.com
commercials.pro
bl927.com
workforceuae.com
innercritictypes.com
unipacksexpress.com
chaitanya99.com
rangamaty.com
7chd.com
keydefi.com
liveporn.wiki
carajedellcasting.com
gooddoggymedia.com
boldercoolware.com
hispekdiamond.com
expnashvilletn.com
swashbug.com
Targets
-
-
Target
product specification.xlsx
-
Size
1.4MB
-
MD5
75c48b4392ae795beeb0317bfaef77bd
-
SHA1
8e3e8daaa18cb3cf0e3b73e90ecbd297c9d5e1ee
-
SHA256
4a5c10a7e9ec7b65f8605186726d4861c5bc96870204e12eb260ebd841e7aedb
-
SHA512
95480a723ab8360552a5d6820cd0ffd1371da2bc49d008620b1b7d034d49c2a6d69e2fd7b62af414f9260ee00f0c48bb8e045c1ca9f9d0de843a3e9b0b759366
-
Xloader Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-