General
-
Target
73242z.xlsm
-
Size
25KB
-
Sample
210311-8hgsn3jaan
-
MD5
b22f93ca8e12b149295dcb58355fc3b6
-
SHA1
cd92f26238bc2670453fb6207231f9efbc04d258
-
SHA256
0645f24b5bc6aad626d4a0a1d3c3f171f0b1c0d17181d5dbf3c2744a0c93bce8
-
SHA512
19d8c1b61d7d0e209359db35d098fec2d97c479409068bf8f8dca3f65c139d7a4d7fe88ec6f30d0d05c879c445b99221b91b06cd391f21722f91d40122aa8d88
Behavioral task
behavioral1
Sample
73242z.xlsm
Resource
win7v20201028
Behavioral task
behavioral2
Sample
73242z.xlsm
Resource
win10v20201028
Malware Config
Extracted
https://tcommerceshop.com/server.php
https://fernandogaleano.com/server.php
Targets
-
-
Target
73242z.xlsm
-
Size
25KB
-
MD5
b22f93ca8e12b149295dcb58355fc3b6
-
SHA1
cd92f26238bc2670453fb6207231f9efbc04d258
-
SHA256
0645f24b5bc6aad626d4a0a1d3c3f171f0b1c0d17181d5dbf3c2744a0c93bce8
-
SHA512
19d8c1b61d7d0e209359db35d098fec2d97c479409068bf8f8dca3f65c139d7a4d7fe88ec6f30d0d05c879c445b99221b91b06cd391f21722f91d40122aa8d88
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Deletes itself
-