General
-
Target
Demande de prix.exe
-
Size
333KB
-
Sample
220316-jaqfyaghar
-
MD5
72c876e6f764bb1928d1f62c909b7c67
-
SHA1
2b75b06f02c650a06ed9ba9db90f3e7348d0b8be
-
SHA256
92ab8821f6c4eedc8bec6abee96520514061e32b772831dc3ecb8e71f8f7bcb3
-
SHA512
3e4a8b38bf5de65deca31259338fa3e2e4287b3f3ec7558e7ea7da59835289c5d286ab9e1a74bec4399b287a94908e58f5d62700ca056fa6702e6af824958b59
Static task
static1
Behavioral task
behavioral1
Sample
Demande de prix.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
Demande de prix.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
xloader
2.5
cbgo
santesha.com
britneysbeautybar.com
sh-cy17.com
jeffcarveragency.com
3117111.com
sobrehosting.net
ddm123.xyz
toxcompliance.com
auditorydesigns.com
vliftfacial.com
ielhii.com
naameliss.com
ritualchariot.com
solchange.com
quatre-vingts.design
lawnmowermashine.com
braceletsstore.net
admappy.com
tollivercoltd.com
vaidix.com
rodrigomartinsadv.com
bouncingskull.com
hamiltonhellerrealestate.com
dream-kidz.com
growupnotgrowold.com
clanginandbangin.com
cornerstone-constructions.com
mcdonalds-delivery.xyz
omnikro.com
nca-group.com
hughers3.com
move-mobius.com
shrivs.com
hoshikuzu-hegemony.com
zpwx17.online
masoncable.com
butecreditunion.com
creativefolksnetwork.xyz
lejanet.com
tacticalslings.club
bestprodutos.com
quirkysoul39.com
sdettest.com
aomendc.xyz
lorticepttoyof6.xyz
nonvaxrnpositions.com
maintainaviation.com
kubanitka.com
fractalmerch.xyz
elbowguru.com
nikiyang.com
cialisactivesupers.com
bestofrochester.info
ynov-rennes.com
saiden8164.com
ffuster.com
papierle.com
dobsonfryedentist.com
rufisquoisedetransit.com
compassionatecuddling.com
kimlady.com
mashinchand.com
semicivilization.com
milamixecommerce.com
ambassadorandceoclub.com
Targets
-
-
Target
Demande de prix.exe
-
Size
333KB
-
MD5
72c876e6f764bb1928d1f62c909b7c67
-
SHA1
2b75b06f02c650a06ed9ba9db90f3e7348d0b8be
-
SHA256
92ab8821f6c4eedc8bec6abee96520514061e32b772831dc3ecb8e71f8f7bcb3
-
SHA512
3e4a8b38bf5de65deca31259338fa3e2e4287b3f3ec7558e7ea7da59835289c5d286ab9e1a74bec4399b287a94908e58f5d62700ca056fa6702e6af824958b59
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-