General

  • Target

    a66e4d60c5d5998a0da5f58566c463a4

  • Size

    36KB

  • Sample

    240226-qdd1msef9w

  • MD5

    a66e4d60c5d5998a0da5f58566c463a4

  • SHA1

    fb563cba522072552ed7a7f59e799d178e35f860

  • SHA256

    630cb12b073dbe9ddfdc990d1b441e66c1c2c3c2dd7927974f96fa0c19557bdf

  • SHA512

    eee185303f4d46fac8cda5e2a64af69115d94229dd86d2defd5a491c3de17d4a107ecec21dff79b49b35815cabd606aed63078c2108e5c9ca435e09bd2399d16

  • SSDEEP

    768:cPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJuMTIFFkNa:Iok3hbdlylKsgqopeJBWhZFGkE+cL2NX

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://statedauto.com/wp-data.php

Targets

    • Target

      a66e4d60c5d5998a0da5f58566c463a4

    • Size

      36KB

    • MD5

      a66e4d60c5d5998a0da5f58566c463a4

    • SHA1

      fb563cba522072552ed7a7f59e799d178e35f860

    • SHA256

      630cb12b073dbe9ddfdc990d1b441e66c1c2c3c2dd7927974f96fa0c19557bdf

    • SHA512

      eee185303f4d46fac8cda5e2a64af69115d94229dd86d2defd5a491c3de17d4a107ecec21dff79b49b35815cabd606aed63078c2108e5c9ca435e09bd2399d16

    • SSDEEP

      768:cPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJuMTIFFkNa:Iok3hbdlylKsgqopeJBWhZFGkE+cL2NX

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks