General
-
Target
c22c4e137fc64ae90346aecfba71d661_JaffaCakes118
-
Size
61KB
-
Sample
240826-drvt4atbqr
-
MD5
c22c4e137fc64ae90346aecfba71d661
-
SHA1
6052695654fa2862d7f69b24047fd00f1614c365
-
SHA256
7788fd156a8f253e578118d0cbfc598e0e28f2c8da3f0476f32544263a13868d
-
SHA512
67b22ee138779d3beada491dbe5c6a16a92ba861d6ced145e4b684ed804df5272397d266e177cee37774921ccfef2357ff12e37818c478d561252feab6921e67
-
SSDEEP
1536:1P8h47EAVJEiw1TNDEPE7WMTxdLjfPz+Mk60Xj+R+mBWAhLcu+:ymgAVSxNl7WIxlj3z+MdkSWAhLcd
Malware Config
Extracted
https://case.gonukkad.com/sys-cache/CjT/
https://starrcoin.net/wp-admin/YT/
http://modelaw.devkind.com.au/wp-admin/cvDRmGK/
http://dprkp.palembang.go.id/sys-cache/7Y4aHw/
http://completeguideblogging.com/euiot/PAuJG/
http://qutiche.cn/wp-admin/Q/
https://shiva-engineering.com/1cj/tKemHV7/
Targets
-
-
Target
sample
-
Size
158KB
-
MD5
5b504b9810a87c1e14ca8366fec0fce9
-
SHA1
b3906a3790fad87ae81bc93acfe4562bdf150290
-
SHA256
33163e89d4430eb23360add971fa52651aac6d7f2212ea3bab450dca4eaafff8
-
SHA512
f16ffb9217907fd2e2f1dd458d2845e376fea4ef3ac67e249f2a1a46153f8d2c62a1cc64da64891271f253a85133654f7561eed8c363b2d5a28bd9c31932827f
-
SSDEEP
1536:A2Fj72Fjmrdi1Ir77zOH98Wj2gpngh+a9YlJiLl:1rfrzOH98ipgyYLl
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-