General
-
Target
47490c17971d549fbe743279793feadd96a285a17f062c225584c671a9a586a4
-
Size
45KB
-
Sample
241111-wzwepstbpq
-
MD5
dec2a501ea254126a3d7f426f83d00d7
-
SHA1
328753be44064d5e0f346a08f3ce4e7ebb7194e9
-
SHA256
47490c17971d549fbe743279793feadd96a285a17f062c225584c671a9a586a4
-
SHA512
7435d6a1cd2963880aaf0e59d989eba584e1a663d06684382ce0cffac99e3507064f59c35a17b27323dd21b78958200022a75184fee2fd24de73330421c65b5e
-
SSDEEP
768:bkPKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAPVdtWgojJcFDqCRt6vuVUeJl1:bsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dd
Behavioral task
behavioral1
Sample
47490c17971d549fbe743279793feadd96a285a17f062c225584c671a9a586a4.xls
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
47490c17971d549fbe743279793feadd96a285a17f062c225584c671a9a586a4.xls
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://fpd.cl/cgi-bin/83E0xgTMc/
https://el-energiaki.gr/wp-content/plugins/really-simple-ssl/testssl/serverport443/WUV5PJA/
https://www.manchesterslt.co.uk/a-to-z-of-slt/Ntrci3Ry/
http://contactworks.nl/layouts/fFxKZabh/
http://baykusoglu.com.tr/wp-admin/Y3sRBcOfZ34wg2sO/
Targets
-
-
Target
47490c17971d549fbe743279793feadd96a285a17f062c225584c671a9a586a4
-
Size
45KB
-
MD5
dec2a501ea254126a3d7f426f83d00d7
-
SHA1
328753be44064d5e0f346a08f3ce4e7ebb7194e9
-
SHA256
47490c17971d549fbe743279793feadd96a285a17f062c225584c671a9a586a4
-
SHA512
7435d6a1cd2963880aaf0e59d989eba584e1a663d06684382ce0cffac99e3507064f59c35a17b27323dd21b78958200022a75184fee2fd24de73330421c65b5e
-
SSDEEP
768:bkPKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAPVdtWgojJcFDqCRt6vuVUeJl1:bsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dd
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-