pload.zip

General
Target

pload.zip

Size

3MB

Sample

211125-vbc3safghk

Score
10 /10
MD5

3381ccacab73599466b83b2258d9e9b5

SHA1

5674f6b1bb8d136c7a9678ff4c09e99761bd7ab7

SHA256

13c3ea5f48d2ce7942a0d9b3c7567e5996b362a97738336f55e5f1008ba3ba8b

SHA512

f7221415d5e870cba44e0bb246539e2893de8637e71274109568e19c1a23c07f1ea4ab84d04d59a57525999c982c07bc9cf0da767058374e4ed5f568ba5cdab2

Malware Config

Extracted

Language ps1
Deobfuscated
URLs
exe.dropper

https://evgeniys.ru/sap-logs/D6/

exe.dropper

http://crownadvertising.ca/wp-includes/OxiAACCoic/

exe.dropper

https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/

exe.dropper

http://immoinvest.com.br/blog_old/wp-admin/luoT/

exe.dropper

https://yoho.love/wp-content/e4laFBDXIvYT6O/

exe.dropper

https://www.168801.xyz/wp-content/6J3CV4meLxvZP/

exe.dropper

https://www.pasionportufuturo.pe/wp-content/XUBS/

Targets
Target

pload/865663204559_17_Nov_2021.xlsm

MD5

477fd718bb764ffe3c5afde16c6c8dd2

Filesize

44KB

Score
10 /10
SHA1

eb932e19d95f88d64270d40cdc0b92c6d1cf63be

SHA256

ee880ebdf26a1bcebe70a7ba17659199833c6107d758e26d37502bed9a225ee3

SHA512

f7d0451ca3670179cc93a680b99f8982204c43054c55eb479c38dc8ea0ba6ba5b6ebea4508569091c07d95a759841455605e6daeab445146b29fc1af377ba267

Signatures

  • Process spawned unexpected child process

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Tasks

                        static1

                        8/10

                        behavioral1

                        10/10