General

  • Target

    3d8f488ed13ea32405b8b21be3cde03c15cdc811cb8dece8bf38a859707f537f.xls

  • Size

    95KB

  • Sample

    220707-e8ysrafcg6

  • MD5

    6d82a5daf80a4cfebbd99a20dfd5031e

  • SHA1

    3869a622dbe8f9f509abaf27facd14d584a63575

  • SHA256

    3d8f488ed13ea32405b8b21be3cde03c15cdc811cb8dece8bf38a859707f537f

  • SHA512

    43867e4e91ffd210584ab08092da865be1f77d065d7538c87985a27a30403b28ee4cdb6599f976a51c507510e76c7fe640e89a7cae3daf4b829471ecd924a402

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://edoraseguros.com.br/cgi-bin/jQNq9wlH1GXU/

xlm40.dropper

http://earthmach.co.za/libraries/tWkZh9YrXbTd6IeX/

xlm40.dropper

http://finvest.rs/wp-admin/Hr9nVNTIHgw59S/

xlm40.dropper

http://efverstedt.se/5jjaV/w7fLEHJ20xn0qD/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://edoraseguros.com.br/cgi-bin/jQNq9wlH1GXU/

Targets

    • Target

      3d8f488ed13ea32405b8b21be3cde03c15cdc811cb8dece8bf38a859707f537f.xls

    • Size

      95KB

    • MD5

      6d82a5daf80a4cfebbd99a20dfd5031e

    • SHA1

      3869a622dbe8f9f509abaf27facd14d584a63575

    • SHA256

      3d8f488ed13ea32405b8b21be3cde03c15cdc811cb8dece8bf38a859707f537f

    • SHA512

      43867e4e91ffd210584ab08092da865be1f77d065d7538c87985a27a30403b28ee4cdb6599f976a51c507510e76c7fe640e89a7cae3daf4b829471ecd924a402

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks