General
-
Target
Purchase order_dated 08-14-2021.zip
-
Size
656KB
-
Sample
210815-bh2t59bz16
-
MD5
996fbe3a63c2e9e8e56f25a706d505df
-
SHA1
3bfba8f68946ab7cfcd26a011f64861456db96c4
-
SHA256
a9042433e15064b25d749406dc01b439e3f0b1831ae0498160d7e639bbc17b41
-
SHA512
39b45bb5446009850d7c09f9c2218e858241350e4a9e7b3508c00fe28afb9fd8ef2a8757ded6cd20795c4739d529afd519b0a3e329f9b61bc643809d99f58007
Static task
static1
Behavioral task
behavioral1
Sample
Purchase order_dated 08-14-2021.exe
Resource
win7v20210410
Malware Config
Extracted
xloader
2.3
bp39
http://www.piadineriae45.com/bp39/
glembos.com
adjud.net
beautifyoils.com
chilewiki.com
duxingzi.com
happygromedia.com
restpostenboerse.com
vowsweddingofficiants.com
ladingjiwa.xyz
keepmakingefforts-001.com
yeniao.net
eyildirmaz.com
sayanghae.com
promoteboost.com
lzft.net
proudindiacompany.com
birchwoodmeridianlink.com
mesinionisasi.com
wwwrigalinks.com
wewearthepants.com
showtimerisingstarz.com
conheonet.club
bigdogshirlfox.com
xn--ehqw60f1ex.club
redmondgrowth-usa.com
myfcmtestsite.com
dreamersclubstudios.com
bulukx.com
netdetameruweb.xyz
djibnb.com
malikakids.com
11298.xyz
shuanglinsm.com
blackliontv.com
louiskochins.com
successfullsolutionworks.com
myrcmall.com
letsplayandgo.com
history-at-home.com
twentyfour4academy.com
immersebyacfw.com
grazestyle.com
asuatlalumni.com
akmh.pro
oldsportapparel.com
alphaprimfi.com
qgrandcafe.com
draggonlng.com
publish.mobi
myuhcvisioni.com
susanpatersonwriter.com
1033308.com
vaca.travel
djmarieco.com
realiszt.com
am-evestment-training.com
plaguelanguage.com
kcpinvest.com
wedilivervc.com
stopneuralink.com
alyvmarli.com
disseminacao.com
testaker.com
officee65.com
Targets
-
-
Target
Purchase order_dated 08-14-2021.exe
-
Size
1.1MB
-
MD5
a76c4bccf8ca3cc9a4ce06f4ec164527
-
SHA1
a87a39b0742b6dd4e93b975307251f7d59e1d21c
-
SHA256
f7f840a7d6ed87875a6376dedef3386e491cfafd01011f27f21b0b2b73a0d6ba
-
SHA512
30f4872fca6e46bf1cfe11489a98223ae563b3c5f16e5c99576b1b59327eee05b72a647cd8a7c0add22168cb8f4155518c8cd4f62d9b2d2cbee143f184dcd279
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Blocklisted process makes network request
-
Deletes itself
-
Suspicious use of SetThreadContext
-