General
-
Target
fd66b0dd872a8a6623b50ed92e2eb37fe5faa88c2ceb20ec66fc3c2a6dedc2db
-
Size
177KB
-
Sample
241113-18tppatnhp
-
MD5
7ce664427cab3b22d32f9cdcfea96e02
-
SHA1
a36d3caca1c9174388ebba55abb83a621114cd1e
-
SHA256
fd66b0dd872a8a6623b50ed92e2eb37fe5faa88c2ceb20ec66fc3c2a6dedc2db
-
SHA512
68d298bc5372c592f168dd4163bb373d9cc085af4b7e896ea15872bc08f705becd7ade397fe2dc73e1a071ec0e90acc2190ee2ffb3729d18bf0d964eac81d974
-
SSDEEP
3072:/L2y/GdynktGDWLS0HZWD5w8K7Nk96D7IBUPZB0zstySfNllXe:/L2k43tGiL3HJk96D7br0z0rllX
Behavioral task
behavioral1
Sample
fd66b0dd872a8a6623b50ed92e2eb37fe5faa88c2ceb20ec66fc3c2a6dedc2db.doc
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd66b0dd872a8a6623b50ed92e2eb37fe5faa88c2ceb20ec66fc3c2a6dedc2db.doc
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://www.yadegarebastan.com/wp-content/mhear/
http://bikerzonebd.com/wp-admin/89gw/
http://shptoys.com/_old/bvGej/
http://www.vestalicom.com/facturation/qgm0t/
http://www.aliounendiaye.com/wp-content/f3hs6j/
Targets
-
-
Target
fd66b0dd872a8a6623b50ed92e2eb37fe5faa88c2ceb20ec66fc3c2a6dedc2db
-
Size
177KB
-
MD5
7ce664427cab3b22d32f9cdcfea96e02
-
SHA1
a36d3caca1c9174388ebba55abb83a621114cd1e
-
SHA256
fd66b0dd872a8a6623b50ed92e2eb37fe5faa88c2ceb20ec66fc3c2a6dedc2db
-
SHA512
68d298bc5372c592f168dd4163bb373d9cc085af4b7e896ea15872bc08f705becd7ade397fe2dc73e1a071ec0e90acc2190ee2ffb3729d18bf0d964eac81d974
-
SSDEEP
3072:/L2y/GdynktGDWLS0HZWD5w8K7Nk96D7IBUPZB0zstySfNllXe:/L2k43tGiL3HJk96D7br0z0rllX
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-