General
-
Target
5e781d5fd024f5cbf83b7cefdd21a232a31b871c284bb0673b74171506cd8fd8
-
Size
242KB
-
Sample
241120-1ryx3syncq
-
MD5
267f126cb0f1e09c5c9c5c623f843b7f
-
SHA1
05e37cddaacda52a5ff0d208d96d32fd40c40e5a
-
SHA256
5e781d5fd024f5cbf83b7cefdd21a232a31b871c284bb0673b74171506cd8fd8
-
SHA512
c59b6e57b58d601ebfb40f93b6754d1fb170b9e13f9deeed41f1807bb73d798488411d4229ccbcc88ab3d12fca5d3287d8d4f524d6a301db7de64e116f4da8a0
-
SSDEEP
6144:sR2k40tGiL3HJk9/D7bZuhEmfo6BokDPyUKjou:sRVQitkh7bAhLoz
Malware Config
Extracted
https://salvacodina.com/wp-admin/qWYFrK/
http://serviska.com/show_cat3/lKzElbNb/
https://bar-ola.com/wp-admin/KIdh35kENT/
http://rinani.com/wp-includes/FFkV/
https://wowmotions.com/wp-admin/A8LwzwQ/
Targets
-
-
Target
5e781d5fd024f5cbf83b7cefdd21a232a31b871c284bb0673b74171506cd8fd8
-
Size
242KB
-
MD5
267f126cb0f1e09c5c9c5c623f843b7f
-
SHA1
05e37cddaacda52a5ff0d208d96d32fd40c40e5a
-
SHA256
5e781d5fd024f5cbf83b7cefdd21a232a31b871c284bb0673b74171506cd8fd8
-
SHA512
c59b6e57b58d601ebfb40f93b6754d1fb170b9e13f9deeed41f1807bb73d798488411d4229ccbcc88ab3d12fca5d3287d8d4f524d6a301db7de64e116f4da8a0
-
SSDEEP
6144:sR2k40tGiL3HJk9/D7bZuhEmfo6BokDPyUKjou:sRVQitkh7bAhLoz
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Drops file in System32 directory
-