General

  • Target

    42990fca1e0275fdc24d36fcc7fd7b18

  • Size

    36KB

  • Sample

    231225-28tv5aehhq

  • MD5

    42990fca1e0275fdc24d36fcc7fd7b18

  • SHA1

    7ceb0068cad556d20080f95aa402257670a026eb

  • SHA256

    3555b36d4dc3f989696d68ca977e410a638df340301b752d54436b39c2230e76

  • SHA512

    bb4fdfd8343b7eac010fbaa18174a4c5d5ec8e7206aab0189ddbe7ef27713f44c66727e780349ad0406a2c2169673bf0c6170e76df737118221c2b12f03db766

  • SSDEEP

    768:kPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJaXRXR1rtKvWEbihX:Aok3hbdlylKsgqopeJBWhZFGkE+cL2NB

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://statedauto.com/wp-data.php

xlm40.dropper

https://markens.online/wp-data.php

Targets

    • Target

      42990fca1e0275fdc24d36fcc7fd7b18

    • Size

      36KB

    • MD5

      42990fca1e0275fdc24d36fcc7fd7b18

    • SHA1

      7ceb0068cad556d20080f95aa402257670a026eb

    • SHA256

      3555b36d4dc3f989696d68ca977e410a638df340301b752d54436b39c2230e76

    • SHA512

      bb4fdfd8343b7eac010fbaa18174a4c5d5ec8e7206aab0189ddbe7ef27713f44c66727e780349ad0406a2c2169673bf0c6170e76df737118221c2b12f03db766

    • SSDEEP

      768:kPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJaXRXR1rtKvWEbihX:Aok3hbdlylKsgqopeJBWhZFGkE+cL2NB

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks