General

  • Target

    47490c17971d549fbe743279793feadd96a285a17f062c225584c671a9a586a4

  • Size

    45KB

  • Sample

    241111-wzwepstbpq

  • MD5

    dec2a501ea254126a3d7f426f83d00d7

  • SHA1

    328753be44064d5e0f346a08f3ce4e7ebb7194e9

  • SHA256

    47490c17971d549fbe743279793feadd96a285a17f062c225584c671a9a586a4

  • SHA512

    7435d6a1cd2963880aaf0e59d989eba584e1a663d06684382ce0cffac99e3507064f59c35a17b27323dd21b78958200022a75184fee2fd24de73330421c65b5e

  • SSDEEP

    768:bkPKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAPVdtWgojJcFDqCRt6vuVUeJl1:bsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dd

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://fpd.cl/cgi-bin/83E0xgTMc/

xlm40.dropper

https://el-energiaki.gr/wp-content/plugins/really-simple-ssl/testssl/serverport443/WUV5PJA/

xlm40.dropper

https://www.manchesterslt.co.uk/a-to-z-of-slt/Ntrci3Ry/

xlm40.dropper

http://contactworks.nl/layouts/fFxKZabh/

xlm40.dropper

http://baykusoglu.com.tr/wp-admin/Y3sRBcOfZ34wg2sO/

Targets

    • Target

      47490c17971d549fbe743279793feadd96a285a17f062c225584c671a9a586a4

    • Size

      45KB

    • MD5

      dec2a501ea254126a3d7f426f83d00d7

    • SHA1

      328753be44064d5e0f346a08f3ce4e7ebb7194e9

    • SHA256

      47490c17971d549fbe743279793feadd96a285a17f062c225584c671a9a586a4

    • SHA512

      7435d6a1cd2963880aaf0e59d989eba584e1a663d06684382ce0cffac99e3507064f59c35a17b27323dd21b78958200022a75184fee2fd24de73330421c65b5e

    • SSDEEP

      768:bkPKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAPVdtWgojJcFDqCRt6vuVUeJl1:bsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dd

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks