General
-
Target
Doc-2020_10_17-7797021.doc
-
Size
162KB
-
Sample
230630-p375cadg4s
-
MD5
cdb6aec7a406b34ce0ac80c2cd008db1
-
SHA1
96fd1c4d7922bbbabb0e3c563efc1ada5067b92f
-
SHA256
fd4a45974318a540bf249d7aa768f6d4ec1bb268bb05e5028935db34aff711f4
-
SHA512
7b2feb826a5454cc67365fb921d8f7af4ba33d0d67970e10f6b9cfa20b0493d8bc46f2de98cde0b5186132ec578d47173579b6ee3be8065b80a714c3dddb5fb9
-
SSDEEP
3072:J+D39Mkq1u2X8SbZE80EvPDFTiwBeY5kb0TUNAuBqVPlB11nBkAhIpJKlyh9X2:J+D39Mkq1u2X8SbZE80EvPDFTiwEYObG
Malware Config
Extracted
https://shroook.com/do-it/BQ/
http://4kwallpaperdownload.com/wp-admin/ET/
https://brahmanimetal.com/horizon-transport/d/
http://resuco.net/backup/kxf/
https://oplungiphone.net/wp-admin/Nx/
https://ludwigmodel.net/wp-admin/i/
https://arkan-memar.com/wp-content/gG/
Targets
-
-
Target
Doc-2020_10_17-7797021.doc
-
Size
162KB
-
MD5
cdb6aec7a406b34ce0ac80c2cd008db1
-
SHA1
96fd1c4d7922bbbabb0e3c563efc1ada5067b92f
-
SHA256
fd4a45974318a540bf249d7aa768f6d4ec1bb268bb05e5028935db34aff711f4
-
SHA512
7b2feb826a5454cc67365fb921d8f7af4ba33d0d67970e10f6b9cfa20b0493d8bc46f2de98cde0b5186132ec578d47173579b6ee3be8065b80a714c3dddb5fb9
-
SSDEEP
3072:J+D39Mkq1u2X8SbZE80EvPDFTiwBeY5kb0TUNAuBqVPlB11nBkAhIpJKlyh9X2:J+D39Mkq1u2X8SbZE80EvPDFTiwEYObG
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-