General
-
Target
SecuriteInfo.com.Exploit.Siggen3.17149.14541.17953
-
Size
38KB
-
Sample
220816-jly78aebhr
-
MD5
c01ceb0fdd801bc10a95074dfda7bf03
-
SHA1
06a60c81777ceaeee0d0d4ac34d84ca2363e3f75
-
SHA256
06914357d09d54db3280e7336663f2f12c8aeb503845a07eed37e06be0853fe7
-
SHA512
9ff80066ff06278e091d6dc194319e5e0e51fde25216fb33bdb1aac1088c3d9dada5102b9181c207e59d1723394c7b5cefc86543142fc1430a5aeba00055a49c
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Exploit.Siggen3.17149.14541.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Exploit.Siggen3.17149.14541.xls
Resource
win10v2004-20220812-en
Malware Config
Extracted
http://facextrade.com.br/wp-includes/certificates/4.txt
Targets
-
-
Target
SecuriteInfo.com.Exploit.Siggen3.17149.14541.17953
-
Size
38KB
-
MD5
c01ceb0fdd801bc10a95074dfda7bf03
-
SHA1
06a60c81777ceaeee0d0d4ac34d84ca2363e3f75
-
SHA256
06914357d09d54db3280e7336663f2f12c8aeb503845a07eed37e06be0853fe7
-
SHA512
9ff80066ff06278e091d6dc194319e5e0e51fde25216fb33bdb1aac1088c3d9dada5102b9181c207e59d1723394c7b5cefc86543142fc1430a5aeba00055a49c
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-