General

  • Target

    49afc24e75525afb23c9fbc14409c80fb57b1d1134a1cbae7ddb51c1b3a98797

  • Size

    40KB

  • Sample

    241120-1wfbjavelk

  • MD5

    615cece8112bda1b1e94e6bca3cc0816

  • SHA1

    73b69ac4c716859cea0583c205206279b2ac606e

  • SHA256

    49afc24e75525afb23c9fbc14409c80fb57b1d1134a1cbae7ddb51c1b3a98797

  • SHA512

    6bc29068209a951b4e45ebab0c44388138f9bd59bf476117951c526d98448bc1e9b7e1053705e90a311d948e665a3b6573f40aaee60f6efe4ecccbab46102fdf

  • SSDEEP

    768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

xlm40.dropper

https://www.ingonherbal.com/application/PhEbceg4Tx/

xlm40.dropper

http://ftp.colibriconstruction.net/cc/KHieqeOsagkmlGIuXc56/

xlm40.dropper

http://commune-ariana.tn/sites/3BvaCmo/

xlm40.dropper

http://dmaicinnovations.com/Swift-5.0.2/jEtePB/

xlm40.dropper

https://drcreative.cz/images/DwThyQntyImCHk0tpba/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

Targets

    • Target

      49afc24e75525afb23c9fbc14409c80fb57b1d1134a1cbae7ddb51c1b3a98797

    • Size

      40KB

    • MD5

      615cece8112bda1b1e94e6bca3cc0816

    • SHA1

      73b69ac4c716859cea0583c205206279b2ac606e

    • SHA256

      49afc24e75525afb23c9fbc14409c80fb57b1d1134a1cbae7ddb51c1b3a98797

    • SHA512

      6bc29068209a951b4e45ebab0c44388138f9bd59bf476117951c526d98448bc1e9b7e1053705e90a311d948e665a3b6573f40aaee60f6efe4ecccbab46102fdf

    • SSDEEP

      768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks