Overview

overview

10

Static

static

catalog-300864781.xls

windows7_x64

10

catalog-300864781.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    catalog-300864781.zip

  • Size

    50KB

  • Sample

    210513-3lga272c2e

  • MD5

    c4986df39f518999ef29dceee48ced52

  • SHA1

    071284cb043d62ae15a43edf48f619f6042eeb19

  • SHA256

    21384a43070c99c8f600c71458ff52c4ea1868a37e8044761be4f24bb6c5a390

  • SHA512

    539481baa961eedfb10d7c0b7d93ae626d0c14347de2ca061dfed7ed26f39b36757f3630549def90b967c0bfd3ef972a8ac11fa2c22685574ed90a1efa2d0fcc

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://smartpalakatva.com/edQsUZOLlE/th.html
xlm40.dropper

https://pilstlcommodities.com/Ov4FlB3lpy/th.html

Targets

    • Target

      catalog-300864781.xls

    • Size

      367KB

    • MD5

      375717e9854009c04afe1c165b852d53

    • SHA1

      351a6c60703e139f34730942ed46fb1338bdf6e0

    • SHA256

      a9a6341003f9cf6eb13ef9dd9a0c78d7e4beb53f2475466ab7fac198cb6f97a0

    • SHA512

      d70271401543899fde7f06f237949725cba2128bd46a463532fbfc07aeec0ac085c2900f6306d2044e706d8828a4376be47c77cff1caa871697f9cb45ca4b8d1

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks