General

  • Target

    1ca1630fa979b2c22fc62cefb890e5153c0d55ca5ac482f51dd43816ded1cbde

  • Size

    95KB

  • Sample

    241119-xdjpfsvmcq

  • MD5

    abc054164d567748be986cb05f2eb657

  • SHA1

    3bb476dbbb8e2f109b43e67fa88466adb1abc435

  • SHA256

    1ca1630fa979b2c22fc62cefb890e5153c0d55ca5ac482f51dd43816ded1cbde

  • SHA512

    d6436e3ac42f6cfb0994b0499c331cb9e7ecca855306263bfe2a91e0d710782f5fae33741692bdee5570f6ede990604d9788f2366cd3c7f849317eb8e22d96cf

  • SSDEEP

    1536:UkKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4HuS4hcTO97v7UYdEJmc:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgq

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://cointrade.world/receipts/0LjXVwpQrhw/

xlm40.dropper

http://www.garantihaliyikama.com/wp-admin/jp64lssPHEe2ii/

xlm40.dropper

http://haircutbar.com/cgi-bin/BC3WAQ8zJY4ALXA4/

xlm40.dropper

http://airhobi.com/system/WLvH1ygkOYQO/

Targets

    • Target

      1ca1630fa979b2c22fc62cefb890e5153c0d55ca5ac482f51dd43816ded1cbde

    • Size

      95KB

    • MD5

      abc054164d567748be986cb05f2eb657

    • SHA1

      3bb476dbbb8e2f109b43e67fa88466adb1abc435

    • SHA256

      1ca1630fa979b2c22fc62cefb890e5153c0d55ca5ac482f51dd43816ded1cbde

    • SHA512

      d6436e3ac42f6cfb0994b0499c331cb9e7ecca855306263bfe2a91e0d710782f5fae33741692bdee5570f6ede990604d9788f2366cd3c7f849317eb8e22d96cf

    • SSDEEP

      1536:UkKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4HuS4hcTO97v7UYdEJmc:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgq

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks