General
-
Target
49ce522ee8d6aac5d7db702d398e0b6bdd01fab467a79a8c0723cfa3bafa73b8
-
Size
186KB
-
Sample
220520-31k4pacfhk
-
MD5
9315ac7bb0fe11fc03a239ff8fd5059c
-
SHA1
5bc51f211db6b6fb4cafd75567edfead8569b620
-
SHA256
49ce522ee8d6aac5d7db702d398e0b6bdd01fab467a79a8c0723cfa3bafa73b8
-
SHA512
149b32cf1f6b490ce083dfb66ad97f4a34c84522ad869cbaf9c8ca959c530bf4c2734c9a90cbbd11ed34064df015140d6985e6acc512f23c459ab8ac7d03cd69
Static task
static1
Behavioral task
behavioral1
Sample
49ce522ee8d6aac5d7db702d398e0b6bdd01fab467a79a8c0723cfa3bafa73b8.doc
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
49ce522ee8d6aac5d7db702d398e0b6bdd01fab467a79a8c0723cfa3bafa73b8.doc
Resource
win10v2004-20220414-en
Malware Config
Extracted
http://vedax.store/cgi-bin/k21-9cbk34xfyh-83/
https://revenuehotelconsultant.com/wp-includes/wwgmZV/
https://ruby9mobile.com/icdx/yUAkhVvqx/
http://psychologische-katzenberatung.de/wp-includes/aJxjHVH/
http://www.kriti24.com/wp-content/GSMPonYO/
Targets
-
-
Target
49ce522ee8d6aac5d7db702d398e0b6bdd01fab467a79a8c0723cfa3bafa73b8
-
Size
186KB
-
MD5
9315ac7bb0fe11fc03a239ff8fd5059c
-
SHA1
5bc51f211db6b6fb4cafd75567edfead8569b620
-
SHA256
49ce522ee8d6aac5d7db702d398e0b6bdd01fab467a79a8c0723cfa3bafa73b8
-
SHA512
149b32cf1f6b490ce083dfb66ad97f4a34c84522ad869cbaf9c8ca959c530bf4c2734c9a90cbbd11ed34064df015140d6985e6acc512f23c459ab8ac7d03cd69
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-