General
-
Target
d4e6035137ca5b1e996b77955302b0417b30998751849f2ec9a789ad17296068
-
Size
88KB
-
Sample
241113-zzg4vsyhpg
-
MD5
f9e6df217ecab5b13e4bcba268d3145e
-
SHA1
898bac1ac28e91952e5382604924adfb4cc46ebd
-
SHA256
d4e6035137ca5b1e996b77955302b0417b30998751849f2ec9a789ad17296068
-
SHA512
7033abe68813e91b54d82d8e0edad09f6f59e613ba0c291003ddf8c2616e5738ac98979a52ee53d859f0dfb1973df3cc206b32ec003fd2fc7e382aa649e8a0f8
-
SSDEEP
1536:qyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQSCkWvgrPE4nWHPNc2AB:qyehv7q2Pjx45uoDGTj+5xtekEvi8/dw
Behavioral task
behavioral1
Sample
d4e6035137ca5b1e996b77955302b0417b30998751849f2ec9a789ad17296068.xls
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
d4e6035137ca5b1e996b77955302b0417b30998751849f2ec9a789ad17296068.xls
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://wearsweetbomb.com/wp-content/15zZybP1EXttxDK4JH/
https://1566xueshe.com/wp-includes/z92ZVqHH8/
http://mymicrogreen.mightcode.com/Fox-C/NWssAbNOJDxhs/
http://o2omart.co.in/infructuose/m4mgt2MeU/
http://mtc.joburg.org.za/-/GBGJeFxXWlNbABv2/
http://www.ama.cu/jpr/VVP/
http://actividades.laforetlanguages.com/wp-admin/dU8Ds/
https://dwwmaster.com/wp-content/1sR2HfFxQnkWuu/
https://edu-media.cn/wp-admin/0JAE/
https://iacademygroup.cl/office/G42LJPLkl/
https://znzhou.top/mode/0Qb/
Targets
-
-
Target
d4e6035137ca5b1e996b77955302b0417b30998751849f2ec9a789ad17296068
-
Size
88KB
-
MD5
f9e6df217ecab5b13e4bcba268d3145e
-
SHA1
898bac1ac28e91952e5382604924adfb4cc46ebd
-
SHA256
d4e6035137ca5b1e996b77955302b0417b30998751849f2ec9a789ad17296068
-
SHA512
7033abe68813e91b54d82d8e0edad09f6f59e613ba0c291003ddf8c2616e5738ac98979a52ee53d859f0dfb1973df3cc206b32ec003fd2fc7e382aa649e8a0f8
-
SSDEEP
1536:qyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQSCkWvgrPE4nWHPNc2AB:qyehv7q2Pjx45uoDGTj+5xtekEvi8/dw
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-