General
-
Target
bb8876eabc45bfebd6f228c4f291df4d1ac834fa9c47678f1fea70335fb476ae
-
Size
88KB
-
Sample
241113-kexw9axpcz
-
MD5
05071739d60341c78f6e7781e87dcdc9
-
SHA1
72b97c21330449a3e0ebebe216973bc0697482db
-
SHA256
bb8876eabc45bfebd6f228c4f291df4d1ac834fa9c47678f1fea70335fb476ae
-
SHA512
7fdc6738b83db176eae2b4aa4f886f16e278dff54576cb69585fed836ab9384c8f8d1ef556b281141ad1ba21addb224b6714022d2230bbe99603c8b6b561ea65
-
SSDEEP
1536:iyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQG5kWvgrPE4nWHPNc2AR:iyehv7q2Pjx45uoDGTj+5xtekEvi8/db
Behavioral task
behavioral1
Sample
bb8876eabc45bfebd6f228c4f291df4d1ac834fa9c47678f1fea70335fb476ae.xls
Resource
win7-20240903-en
Malware Config
Extracted
http://wearsweetbomb.com/wp-content/15zZybP1EXttxDK4JH/
https://1566xueshe.com/wp-includes/z92ZVqHH8/
http://mymicrogreen.mightcode.com/Fox-C/NWssAbNOJDxhs/
http://o2omart.co.in/infructuose/m4mgt2MeU/
http://mtc.joburg.org.za/-/GBGJeFxXWlNbABv2/
http://www.ama.cu/jpr/VVP/
http://actividades.laforetlanguages.com/wp-admin/dU8Ds/
https://dwwmaster.com/wp-content/1sR2HfFxQnkWuu/
https://edu-media.cn/wp-admin/0JAE/
https://iacademygroup.cl/office/G42LJPLkl/
https://znzhou.top/mode/0Qb/
Targets
-
-
Target
bb8876eabc45bfebd6f228c4f291df4d1ac834fa9c47678f1fea70335fb476ae
-
Size
88KB
-
MD5
05071739d60341c78f6e7781e87dcdc9
-
SHA1
72b97c21330449a3e0ebebe216973bc0697482db
-
SHA256
bb8876eabc45bfebd6f228c4f291df4d1ac834fa9c47678f1fea70335fb476ae
-
SHA512
7fdc6738b83db176eae2b4aa4f886f16e278dff54576cb69585fed836ab9384c8f8d1ef556b281141ad1ba21addb224b6714022d2230bbe99603c8b6b561ea65
-
SSDEEP
1536:iyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQG5kWvgrPE4nWHPNc2AR:iyehv7q2Pjx45uoDGTj+5xtekEvi8/db
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-