General
-
Target
b8b792ab4a5676ee232d98a0b5778893679c10d53c066e94780e3a4ceab53271
-
Size
88KB
-
Sample
241113-j6swyaxmh1
-
MD5
b47e95ab49ef7192f067c401bc67fc08
-
SHA1
3f1e54cfa2ff8154538d002a62b38ddcbb08b63b
-
SHA256
b8b792ab4a5676ee232d98a0b5778893679c10d53c066e94780e3a4ceab53271
-
SHA512
ab60e962d680ca1a99e21dc3be4b5336c179278002310a48c6a6c66e76f6781d0f218c2c7a46c2108be5113d7f40fa4d9d286fb45a5adac7bd0d44bb7cd03e28
-
SSDEEP
1536:Pyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAFkWvgrPE4nWHPNc2AZ:Pyehv7q2Pjx45uoDGTj+5xtekEvi8/dR
Behavioral task
behavioral1
Sample
b8b792ab4a5676ee232d98a0b5778893679c10d53c066e94780e3a4ceab53271.xls
Resource
win7-20241010-en
Malware Config
Extracted
http://wearsweetbomb.com/wp-content/15zZybP1EXttxDK4JH/
https://1566xueshe.com/wp-includes/z92ZVqHH8/
http://mymicrogreen.mightcode.com/Fox-C/NWssAbNOJDxhs/
http://o2omart.co.in/infructuose/m4mgt2MeU/
http://mtc.joburg.org.za/-/GBGJeFxXWlNbABv2/
http://www.ama.cu/jpr/VVP/
http://actividades.laforetlanguages.com/wp-admin/dU8Ds/
https://dwwmaster.com/wp-content/1sR2HfFxQnkWuu/
https://edu-media.cn/wp-admin/0JAE/
https://iacademygroup.cl/office/G42LJPLkl/
https://znzhou.top/mode/0Qb/
Targets
-
-
Target
b8b792ab4a5676ee232d98a0b5778893679c10d53c066e94780e3a4ceab53271
-
Size
88KB
-
MD5
b47e95ab49ef7192f067c401bc67fc08
-
SHA1
3f1e54cfa2ff8154538d002a62b38ddcbb08b63b
-
SHA256
b8b792ab4a5676ee232d98a0b5778893679c10d53c066e94780e3a4ceab53271
-
SHA512
ab60e962d680ca1a99e21dc3be4b5336c179278002310a48c6a6c66e76f6781d0f218c2c7a46c2108be5113d7f40fa4d9d286fb45a5adac7bd0d44bb7cd03e28
-
SSDEEP
1536:Pyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAFkWvgrPE4nWHPNc2AZ:Pyehv7q2Pjx45uoDGTj+5xtekEvi8/dR
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-