General
-
Target
508be46ec5246b1d5ce1aaa4593c43c8
-
Size
438KB
-
Sample
230125-j2f2ksha8v
-
MD5
508be46ec5246b1d5ce1aaa4593c43c8
-
SHA1
f597d8e1b22a35c77e296c95187e974a2ce3ba20
-
SHA256
11ed21044757efeacdfb3e2b08f35c7ea473f0698b8455655dc115bf30be11db
-
SHA512
af9768b260914561dcc9150ae1d14cd5c4ed6f09e85d21f3224a90cec802d9689f55ee0461564f5fda37ab564867dbd06c89214327cebba49c3c6f0f7eeb6e1a
-
SSDEEP
12288:q947a/JjsLZjXYc7X0/aXCKli04OaZ1XAYThF0:gurYc7E/i004OS1ThF0
Behavioral task
behavioral1
Sample
508be46ec5246b1d5ce1aaa4593c43c8.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
508be46ec5246b1d5ce1aaa4593c43c8.xls
Resource
win10v2004-20221111-en
Malware Config
Extracted
https://wildmanwildfood.com/wp-admin/wxyadXKXFe/
https://ashven.co.uk/wp-includes/UwBairqGXVb11tCu/
https://aigenix.comartstudios.com/cgi-bin/ZZ8HCNr40H/
https://fastonlineearn.com/wp-content/L/
https://mbmscaffolding.co.uk/test/3j/
https://ineslebuhan.com/wp-includes/7dLR8UB3RFfSHd4cZN/
https://mccoygloballinks.com/cgi-bin/HvZWLrLljiRj2ck/
http://lonaomer.com/wp-content/6G/
https://tainformado.com.br/wp-content/0Ysot/
https://nifdtb.in/wp-content/9uHo3GBgyIQ/
https://sdn3sajen.stormapp.in/wp-admin/Xc6Z/
https://narsanat.com/banner/TnIhz/
https://vanessanascimento.com.br/auren-xbox/cDD2dfW/
https://medvital.com.br/arquivos/q6ZjbPPoR7l/
https://mcjalandhar.in/1950-kill/BMoLHJM4g/
https://nuranabd.com/wp-content/BhYOZ2pJV5q/
https://sdigitaltv.online/wp-admin/rpRCArrXjpoUXo/
http://news.leta.com.vn/-/NQOY80o/
Targets
-
-
Target
508be46ec5246b1d5ce1aaa4593c43c8
-
Size
438KB
-
MD5
508be46ec5246b1d5ce1aaa4593c43c8
-
SHA1
f597d8e1b22a35c77e296c95187e974a2ce3ba20
-
SHA256
11ed21044757efeacdfb3e2b08f35c7ea473f0698b8455655dc115bf30be11db
-
SHA512
af9768b260914561dcc9150ae1d14cd5c4ed6f09e85d21f3224a90cec802d9689f55ee0461564f5fda37ab564867dbd06c89214327cebba49c3c6f0f7eeb6e1a
-
SSDEEP
12288:q947a/JjsLZjXYc7X0/aXCKli04OaZ1XAYThF0:gurYc7E/i004OS1ThF0
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-