General

  • Target

    621f61036b3455c2f208244d427a0a1aJaffaCakes118

  • Size

    259KB

  • Sample

    240523-asr8taeg4s

  • MD5

    621f61036b3455c2f208244d427a0a1a

  • SHA1

    97a90cfcc9f8d1a268ae29c0fac7247798f68558

  • SHA256

    e48d84f3821901ac175931583751b6dc89592aaf1ea9896d95adb131652bedcc

  • SHA512

    27bd362a6938380823efd3c5608fe4d7be553fc363b7a367a428a0c96ec65c050c488cb419ee3d3a17429004be52b0eefdad5c306f3e8a683dbd8f50267c0c2b

  • SSDEEP

    3072:8H9nBf4SuEjAhmAMOc7kkkko1rkGuF3tBInxGGq5nyXJm9YBmjDM2lNdsiGCT:8FVeEsjdXRC3jexGG6MYWof5dsiGCT

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.gurutransfer.com/cGQPt/

exe.dropper

http://www.prava-traktorista.ru/Pny/

exe.dropper

http://www.noobingame.tk/rP2E/

exe.dropper

http://www.frigolutasima.net/m/

exe.dropper

http://www.batikcar.com/GDW/

Targets

    • Target

      621f61036b3455c2f208244d427a0a1aJaffaCakes118

    • Size

      259KB

    • MD5

      621f61036b3455c2f208244d427a0a1a

    • SHA1

      97a90cfcc9f8d1a268ae29c0fac7247798f68558

    • SHA256

      e48d84f3821901ac175931583751b6dc89592aaf1ea9896d95adb131652bedcc

    • SHA512

      27bd362a6938380823efd3c5608fe4d7be553fc363b7a367a428a0c96ec65c050c488cb419ee3d3a17429004be52b0eefdad5c306f3e8a683dbd8f50267c0c2b

    • SSDEEP

      3072:8H9nBf4SuEjAhmAMOc7kkkko1rkGuF3tBInxGGq5nyXJm9YBmjDM2lNdsiGCT:8FVeEsjdXRC3jexGG6MYWof5dsiGCT

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks