General
-
Target
69257750edab7e9df8d5f16986255ad2_JaffaCakes118
-
Size
143KB
-
Sample
240523-as4xlseg5s
-
MD5
69257750edab7e9df8d5f16986255ad2
-
SHA1
412e4e014be73806dbb1b991a17fcf212d0c8cf5
-
SHA256
f61a7749ba4a209db07cd10c799a6563aac71bcdc4535f1d6777cc685b6e1d6d
-
SHA512
f3d4e23f3877f9a718715721552846459f04ef3d8c8cf674e08ecc6e7899b5c5d4a8be33c4509517b561369b475b187e4d4ecfeb7ec5677943ce739b35568df6
-
SSDEEP
3072:u77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qcDYQc1/1+a1KKDJbwT/JASiTSvc:u77HUUUUUUUUUUUUUUUUUUUT52VFYQcL
Malware Config
Extracted
http://sastodharan.com/wp-admin/IWYPXKtgEa/
https://www.nesagaviria.com/cloud/wp8k5p_xoqog-4543006057/
http://healthshiny.com/wp-admin/ecCESGKTbF/
http://www.averefiducia.com/wp-content/plugins/si-captcha-for-wordpress/gckzzkAsO/
https://joymakers.joyventures.com/wp-content/uBhQpaMuh/
Targets
-
-
Target
69257750edab7e9df8d5f16986255ad2_JaffaCakes118
-
Size
143KB
-
MD5
69257750edab7e9df8d5f16986255ad2
-
SHA1
412e4e014be73806dbb1b991a17fcf212d0c8cf5
-
SHA256
f61a7749ba4a209db07cd10c799a6563aac71bcdc4535f1d6777cc685b6e1d6d
-
SHA512
f3d4e23f3877f9a718715721552846459f04ef3d8c8cf674e08ecc6e7899b5c5d4a8be33c4509517b561369b475b187e4d4ecfeb7ec5677943ce739b35568df6
-
SSDEEP
3072:u77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qcDYQc1/1+a1KKDJbwT/JASiTSvc:u77HUUUUUUUUUUUUUUUUUUUT52VFYQcL
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-