Overview

overview

10

Static

static

8

ee649fe793...29.xls

windows7-x64

10

ee649fe793...29.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee649fe7939592811d5eea52d13f4776f82d33634c1fa37657e3acde44676f29

  • Size

    243KB

  • Sample

    241120-13r9nsyqbl

  • MD5

    f3b2c6bc5ad19119261b2bbe7e12a00b

  • SHA1

    d1a34cc4d4a9e214d1ef41a4016bf8b35df59dd4

  • SHA256

    ee649fe7939592811d5eea52d13f4776f82d33634c1fa37657e3acde44676f29

  • SHA512

    60c606da2cf9c91a788072ae419d658362880da4f43e338ed0ea420f229b99f4b787f5b49aa650f9dbc468cc0e9b1eaaab34a69dd9c5a51b28d00fcc6767fb82

  • SSDEEP

    6144:DKpbdrHYrMue8q7QPX+5xtFEdi8/dg/ThvsiKIjvl5fd1Xh8rsoX/w/0Y:ghEXs5fXR8rsNT

Score
10/10
discoverymacroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://servidorcarlosydavid.es/wp-admin/jkNPgHxNjF/
xlm40.dropper

https://gmo-sol-p10.heteml.jp/includes/UoJMgYAc1EES/
xlm40.dropper

https://iashanghai.cn/z/Z1PG6ulBh20plss/
xlm40.dropper

https://www.pasionportufuturo.pe/wp-content/HkUfvw0xuCy5/
xlm40.dropper

http://dmdagents.com.au/vqwbgz/CL4Bo4C4VS0deg/

Targets

    • Target

      ee649fe7939592811d5eea52d13f4776f82d33634c1fa37657e3acde44676f29

    • Size

      243KB

    • MD5

      f3b2c6bc5ad19119261b2bbe7e12a00b

    • SHA1

      d1a34cc4d4a9e214d1ef41a4016bf8b35df59dd4

    • SHA256

      ee649fe7939592811d5eea52d13f4776f82d33634c1fa37657e3acde44676f29

    • SHA512

      60c606da2cf9c91a788072ae419d658362880da4f43e338ed0ea420f229b99f4b787f5b49aa650f9dbc468cc0e9b1eaaab34a69dd9c5a51b28d00fcc6767fb82

    • SSDEEP

      6144:DKpbdrHYrMue8q7QPX+5xtFEdi8/dg/ThvsiKIjvl5fd1Xh8rsoX/w/0Y:ghEXs5fXR8rsNT

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks