General
-
Target
55a0a2555c47ccd4601ba0e29748d103924b48404a19bc1c9e45a39487e1a879
-
Size
145KB
-
Sample
241120-14fbhavjfw
-
MD5
54b8ec0ac794b5fb93f5a72fa210d015
-
SHA1
640918047ea474494b24512f989bd086c2e9e9d7
-
SHA256
55a0a2555c47ccd4601ba0e29748d103924b48404a19bc1c9e45a39487e1a879
-
SHA512
c315531767ebaed26c88d5ebb9c58e5fafa0c157856b4e4f5c39e813d6845b571498788d43f4ee8e503c3be00673456830646ac33e81921040df1dd4e424f110
-
SSDEEP
3072:uBeY5kb0TUNAuBqVPlB11nBsrzdsIpbJ9goSD8RW9:uEYOb0TUquBqt7nBOZsIpbJtxRW9
Malware Config
Extracted
https://newmoontec.com/wp-content/uploads/8R0lFV/
http://kiasoo.com/dl/7y7I1V/
http://malkaragida.com/content/Una/
http://xiaolechen.com/pollinodial/5lTy0/
http://mallowsvirtualcreatives.com/wp-content/2pw1/
https://rfcrfc.com/wp-admin/oZ/
http://bbs.rfcrfc.com/api/V/
Targets
-
-
Target
55a0a2555c47ccd4601ba0e29748d103924b48404a19bc1c9e45a39487e1a879
-
Size
145KB
-
MD5
54b8ec0ac794b5fb93f5a72fa210d015
-
SHA1
640918047ea474494b24512f989bd086c2e9e9d7
-
SHA256
55a0a2555c47ccd4601ba0e29748d103924b48404a19bc1c9e45a39487e1a879
-
SHA512
c315531767ebaed26c88d5ebb9c58e5fafa0c157856b4e4f5c39e813d6845b571498788d43f4ee8e503c3be00673456830646ac33e81921040df1dd4e424f110
-
SSDEEP
3072:uBeY5kb0TUNAuBqVPlB11nBsrzdsIpbJ9goSD8RW9:uEYOb0TUquBqt7nBOZsIpbJtxRW9
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-