General
-
Target
pload.zip
-
Size
3.9MB
-
Sample
211125-vbc3safghk
-
MD5
3381ccacab73599466b83b2258d9e9b5
-
SHA1
5674f6b1bb8d136c7a9678ff4c09e99761bd7ab7
-
SHA256
13c3ea5f48d2ce7942a0d9b3c7567e5996b362a97738336f55e5f1008ba3ba8b
-
SHA512
f7221415d5e870cba44e0bb246539e2893de8637e71274109568e19c1a23c07f1ea4ab84d04d59a57525999c982c07bc9cf0da767058374e4ed5f568ba5cdab2
Malware Config
Extracted
https://evgeniys.ru/sap-logs/D6/
http://crownadvertising.ca/wp-includes/OxiAACCoic/
https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/
http://immoinvest.com.br/blog_old/wp-admin/luoT/
https://yoho.love/wp-content/e4laFBDXIvYT6O/
https://www.168801.xyz/wp-content/6J3CV4meLxvZP/
https://www.pasionportufuturo.pe/wp-content/XUBS/
Targets
-
-
Target
pload/865663204559_17_Nov_2021.xlsm
-
Size
44KB
-
MD5
477fd718bb764ffe3c5afde16c6c8dd2
-
SHA1
eb932e19d95f88d64270d40cdc0b92c6d1cf63be
-
SHA256
ee880ebdf26a1bcebe70a7ba17659199833c6107d758e26d37502bed9a225ee3
-
SHA512
f7d0451ca3670179cc93a680b99f8982204c43054c55eb479c38dc8ea0ba6ba5b6ebea4508569091c07d95a759841455605e6daeab445146b29fc1af377ba267
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-