General

  • Target

    62424be1bb943061d0c7d271540929fd2cb6b48d6c124bb85b19b75b53f0adb8

  • Size

    56KB

  • Sample

    241119-xrmm9szgkh

  • MD5

    48a89b9dfa9ce7e47a48bb3cf0515f8c

  • SHA1

    865722bb52b3d3a3cd8e652dc17a726a0f6b40ad

  • SHA256

    62424be1bb943061d0c7d271540929fd2cb6b48d6c124bb85b19b75b53f0adb8

  • SHA512

    932cd25620582b631b4bdba0d0fb1545a60bcb96fc47e0a375f3b2c9fbb02be6816193f4b9e7157f7a45b7aa93984e82cbafbb36729599b51e10c5a71c1f8022

  • SSDEEP

    1536:WUsgWy4WV8cPkkhN+8ZvOVWoNwlQolOko3t0F5uVAwk6:Jsnbcpn+8ZGIFK73tMQ5

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.equus.com/2i8yt/GhBSz6peG/

xlm40.dropper

http://afimermer.com.tr/tema/9woGfuH3IPfNqmhC/

xlm40.dropper

http://agenciadesarrollorivera.com.uy/wp-admin/I8Icji7qqkLMCa0K5/

xlm40.dropper

https://computercollegiate.com.pk/lms.computercollegiate.com.pk/9u2YYQEKKr/

xlm40.dropper

http://bousebre.es/wordpress_bo/kpKKEIl/

xlm40.dropper

http://cookingstudio.co.il/join/NbvVMsJ/

xlm40.dropper

http://djhost.nl/radio/VUIq8xjsHUGZxJ/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.equus.com/2i8yt/GhBSz6peG/

Targets

    • Target

      62424be1bb943061d0c7d271540929fd2cb6b48d6c124bb85b19b75b53f0adb8

    • Size

      56KB

    • MD5

      48a89b9dfa9ce7e47a48bb3cf0515f8c

    • SHA1

      865722bb52b3d3a3cd8e652dc17a726a0f6b40ad

    • SHA256

      62424be1bb943061d0c7d271540929fd2cb6b48d6c124bb85b19b75b53f0adb8

    • SHA512

      932cd25620582b631b4bdba0d0fb1545a60bcb96fc47e0a375f3b2c9fbb02be6816193f4b9e7157f7a45b7aa93984e82cbafbb36729599b51e10c5a71c1f8022

    • SSDEEP

      1536:WUsgWy4WV8cPkkhN+8ZvOVWoNwlQolOko3t0F5uVAwk6:Jsnbcpn+8ZGIFK73tMQ5

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks