General
-
Target
New Offer to Thalassa Imports nv-sa._200317.xlsx.exe
-
Size
597KB
-
Sample
211102-khzj9acbe7
-
MD5
25f5c52cdda04e1e029d2326e29ca8d5
-
SHA1
f166d6adfd2c7e369948252546d2113a7ee07224
-
SHA256
881100c6150cdd242daa1eddaf33aaa6069cf22fa401d02a51f5994be17c49c3
-
SHA512
a0b43ad104de5701c299db0763494fed609b282eadf03fd6b20aa02910197129fa2511f42ba0cca1ea90cf9f93d1e893697c96972356c4601b4fb34422f71a1d
Malware Config
Extracted
xloader
2.5
pufi
http://www.homestechs.com/pufi/
fusiongroupgames.net
hugevari.com
rebeccagriffiths.com
trocaoferta.com
theslashapp.com
codezonesoftware.xyz
sottocommunications.com
minicreators.online
course2millions.com
hfm5n1dhkjqwpe.xyz
xlab-ub.com
silvanaribeirocake.com
thefabinteriordesign.com
mg-leadership.com
petbort.com
ndust.net
203040302.xyz
jakital.com
shophuunghia.info
rednacionaldejuecesrd.net
Targets
-
-
Target
New Offer to Thalassa Imports nv-sa._200317.xlsx.exe
-
Size
597KB
-
MD5
25f5c52cdda04e1e029d2326e29ca8d5
-
SHA1
f166d6adfd2c7e369948252546d2113a7ee07224
-
SHA256
881100c6150cdd242daa1eddaf33aaa6069cf22fa401d02a51f5994be17c49c3
-
SHA512
a0b43ad104de5701c299db0763494fed609b282eadf03fd6b20aa02910197129fa2511f42ba0cca1ea90cf9f93d1e893697c96972356c4601b4fb34422f71a1d
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-