General
-
Target
3952.xlsm.zip
-
Size
23KB
-
Sample
210314-lv2kdby9vx
-
MD5
a69f6fd9c508d1dd139c838b476ed55f
-
SHA1
36b159024a0442ae2ee8da7a6852150d112263ba
-
SHA256
1cf56cb4154e8d0ac4ac72fc7b5ec85627040c5c8f3af3adec61e83bb3cf71ec
-
SHA512
fafa59c11c898643a9ad44605bf39ba94150a82fff8d0b3bde09c57674ae103ea9e54e46ed060bbd366a478816294feb5f438d68487a14a588b183771f285542
Behavioral task
behavioral1
Sample
3952.xlsm
Resource
win7v20201028
Behavioral task
behavioral2
Sample
3952.xlsm
Resource
win10v20201028
Malware Config
Extracted
https://catedraloor.com/server.php
https://fernandogaleano.com/server.php
Targets
-
-
Target
3952.xlsm
-
Size
25KB
-
MD5
3e171388734cd76415b35beebaf35dc8
-
SHA1
6c12e129fedce3b929cd684b338fca55f4c0f68b
-
SHA256
45e10a76f4162773e2456f75a1781729aa203600be5b041e17e31a4d9ac415f8
-
SHA512
959293bb33adee979eeaa77b5c08676f1de58b0cd2d81e52e292002454d8993eca8b315f2c2614595f3a6ccd290e0f68e6bca6c0d5c9b7cea4b7633432705daf
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Deletes itself
-