General
-
Target
5cf13a476f1f40376b32a6fd7b866a8d1441f98cc131a8bbcebe35e7dcf0dff2
-
Size
34KB
-
Sample
240726-z5zk4aydnc
-
MD5
5c2797ab79310c379e44ae2987dca9f3
-
SHA1
2fcc0edddc6274f89e03711ae40c8e5ef0bb47e9
-
SHA256
5cf13a476f1f40376b32a6fd7b866a8d1441f98cc131a8bbcebe35e7dcf0dff2
-
SHA512
6c31d93e8f3a22ce20ecfe3d6a0e2b1c72f9526b4c39a197dea6d47ffb282a00cb44768bdd57c57a2772af749d989564a4b6ec8b14f47d997a1e5cabee013a4c
-
SSDEEP
384:A3SiSwvxjk+tb/sWk+MlTT50jmtcgWFeFaJH:A3Vxw+tD7SXMgWFeFa9
Behavioral task
behavioral1
Sample
5cf13a476f1f40376b32a6fd7b866a8d1441f98cc131a8bbcebe35e7dcf0dff2.doc
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5cf13a476f1f40376b32a6fd7b866a8d1441f98cc131a8bbcebe35e7dcf0dff2.doc
Resource
win10v2004-20240709-en
Malware Config
Extracted
http://192.168.166.158/payload.txt
Targets
-
-
Target
5cf13a476f1f40376b32a6fd7b866a8d1441f98cc131a8bbcebe35e7dcf0dff2
-
Size
34KB
-
MD5
5c2797ab79310c379e44ae2987dca9f3
-
SHA1
2fcc0edddc6274f89e03711ae40c8e5ef0bb47e9
-
SHA256
5cf13a476f1f40376b32a6fd7b866a8d1441f98cc131a8bbcebe35e7dcf0dff2
-
SHA512
6c31d93e8f3a22ce20ecfe3d6a0e2b1c72f9526b4c39a197dea6d47ffb282a00cb44768bdd57c57a2772af749d989564a4b6ec8b14f47d997a1e5cabee013a4c
-
SSDEEP
384:A3SiSwvxjk+tb/sWk+MlTT50jmtcgWFeFaJH:A3Vxw+tD7SXMgWFeFa9
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Drops file in System32 directory
-