General
-
Target
Interform MLtd Novenmber Order.xlsx
-
Size
186KB
-
Sample
211102-mfdacahccr
-
MD5
4f7ab6d7e5b849e7c7eae32bf90225c2
-
SHA1
4681b26c0c84cf92ed2a5eb52446e2770dfc52c1
-
SHA256
cbb0aa469e249e6f858c9db8e4b66a74f4344f7ea3bdb41c9d7cdb9f8d568af5
-
SHA512
dae7df48dc932bd7f532b0e1d5fc8e5cec2dc9b9dbc8d17442dea31c74bfd527fcace1f88441a39d8188dcd4cb0a5217cf5f54e29029a87eeb215b5835538bbf
Static task
static1
Behavioral task
behavioral1
Sample
Interform MLtd Novenmber Order.xlsx
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Interform MLtd Novenmber Order.xlsx
Resource
win10-en-20210920
Malware Config
Extracted
xloader
2.5
sb6n
http://www.best5amazon.com/sb6n/
bogosamba.com
inmobiliariapuertalavilla.com
nopressurewellness.com
hairshopamity.com
epicmoments360.com
tutorgpa.com
fucibou.xyz
135631.com
portraydashcam.com
raqsarabia.com
okantis.net
vongquaykimcuongfreefire.online
prodom.online
5537sbishop.info
lisakenneyinc.com
fivetime.xyz
borzv.com
joungla.com
mas-urbano.com
sjczyw.com
kanesia.com
cursovendasafiliagram.website
lumledstore.com
id-434563.site
tinkerform.com
chainedorchange.com
147149cale.com
windmillbusiness.com
moccocity.com
linkinsense.net
asportrans.com
texasmotorcycletransport.com
unviajeinsospechado.com
rishaande.tech
happylifecompanies.com
thewtot.com
homeyhousy.com
schoolx.space
gr-pcs.com
bedrocksolution.net
investorsbamk.com
rewoodlovro.quest
scratchforce.com
roosteco.com
zacharyparkerporward5.com
itranslate.club
mastessrhalco.com
jytyxyc.xyz
theelegantflamestore.com
grausalvarez.com
riveroakdevelopment.com
intervalagency.com
yugenft.com
6672pk.com
euphoricpucci.com
sedlmayer.gmbh
caricomrealestate.online
herseymagazamda.com
kefirusa.com
royalclnglegacy.com
toptanalcimalzemeleri.com
recbi56ni.com
transformdom.net
writersmight.com
Targets
-
-
Target
Interform MLtd Novenmber Order.xlsx
-
Size
186KB
-
MD5
4f7ab6d7e5b849e7c7eae32bf90225c2
-
SHA1
4681b26c0c84cf92ed2a5eb52446e2770dfc52c1
-
SHA256
cbb0aa469e249e6f858c9db8e4b66a74f4344f7ea3bdb41c9d7cdb9f8d568af5
-
SHA512
dae7df48dc932bd7f532b0e1d5fc8e5cec2dc9b9dbc8d17442dea31c74bfd527fcace1f88441a39d8188dcd4cb0a5217cf5f54e29029a87eeb215b5835538bbf
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Xloader Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-