Overview

overview

10

Static

static

8

9479285a67...9f.xls

windows7-x64

10

9479285a67...9f.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9479285a674ad1aeafcfd4624cfd5157b1abdd56058ad4ac6100b1580281bd9f

  • Size

    95KB

  • Sample

    241120-16sdvavgjl

  • MD5

    9b25ca227ff6e7ad5a5d474bfffae893

  • SHA1

    85208dfe5eac164b3a5cd417b7d37f32648779dd

  • SHA256

    9479285a674ad1aeafcfd4624cfd5157b1abdd56058ad4ac6100b1580281bd9f

  • SHA512

    0b79b7ca678240fee3a0e5c34bf8b8a9c50000a843800f63fe071430478fd305186ad6da4aeda4804a5888299d4e840c58599867f70db0ed458d6fce8a7d4a57

  • SSDEEP

    1536:UkKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4HuS4hcTO97v7UYdEJm8:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgK

Score
10/10
discoverymacroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://cointrade.world/receipts/0LjXVwpQrhw/
xlm40.dropper

http://www.garantihaliyikama.com/wp-admin/jp64lssPHEe2ii/
xlm40.dropper

http://haircutbar.com/cgi-bin/BC3WAQ8zJY4ALXA4/
xlm40.dropper

http://airhobi.com/system/WLvH1ygkOYQO/

Targets

    • Target

      9479285a674ad1aeafcfd4624cfd5157b1abdd56058ad4ac6100b1580281bd9f

    • Size

      95KB

    • MD5

      9b25ca227ff6e7ad5a5d474bfffae893

    • SHA1

      85208dfe5eac164b3a5cd417b7d37f32648779dd

    • SHA256

      9479285a674ad1aeafcfd4624cfd5157b1abdd56058ad4ac6100b1580281bd9f

    • SHA512

      0b79b7ca678240fee3a0e5c34bf8b8a9c50000a843800f63fe071430478fd305186ad6da4aeda4804a5888299d4e840c58599867f70db0ed458d6fce8a7d4a57

    • SSDEEP

      1536:UkKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4HuS4hcTO97v7UYdEJm8:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgK

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks