General

  • Target

    8e6de0a3188e56b76f0dd51db32722c7

  • Size

    36KB

  • Sample

    240204-g2nejsdfcj

  • MD5

    8e6de0a3188e56b76f0dd51db32722c7

  • SHA1

    cb8260272a5bcf24131619cc3b35c313687c5cfe

  • SHA256

    bb74f9285e3142fb5724f2299ea18ff7cd41493507ab1cc3e9f7163edbb597f9

  • SHA512

    398dde0762f6544df9fb5385df637c91f188760629a25fa7634256f4f41df28cbbd7c57b0c736e7fd44743b413f0cdb1733ed02e0ae1f8f48ed818b2436f85a4

  • SSDEEP

    768:APqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJU6/ggaYQCjMOy5F:Mok3hbdlylKsgqopeJBWhZFGkE+cL2NB

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://statedauto.com/wp-data.php

xlm40.dropper

https://markens.online/wp-data.php

Targets

    • Target

      8e6de0a3188e56b76f0dd51db32722c7

    • Size

      36KB

    • MD5

      8e6de0a3188e56b76f0dd51db32722c7

    • SHA1

      cb8260272a5bcf24131619cc3b35c313687c5cfe

    • SHA256

      bb74f9285e3142fb5724f2299ea18ff7cd41493507ab1cc3e9f7163edbb597f9

    • SHA512

      398dde0762f6544df9fb5385df637c91f188760629a25fa7634256f4f41df28cbbd7c57b0c736e7fd44743b413f0cdb1733ed02e0ae1f8f48ed818b2436f85a4

    • SSDEEP

      768:APqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJU6/ggaYQCjMOy5F:Mok3hbdlylKsgqopeJBWhZFGkE+cL2NB

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks