General
-
Target
f0204f7ea7a6d14cf24061183174987189ccdcc7091c4f6b3ba5bee07e8942e1
-
Size
45KB
-
Sample
241120-221ebsvqd1
-
MD5
4835f3c1d2e322723a341bba9b7a92e2
-
SHA1
661508b56abc5a7886ae8f90669010ff273a620e
-
SHA256
f0204f7ea7a6d14cf24061183174987189ccdcc7091c4f6b3ba5bee07e8942e1
-
SHA512
85cc15bf34f6b795b9583156e5478b82bf9b43a373926f1470a4dfe4edc287c27c651adaba7c3cca587c898ae8011eedd9ce6052162a3435d27cfbdfcc81a937
-
SSDEEP
768:bkPKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAPVdtWgojJcFDqCRt6vuVUeJlZ:bsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dB
Behavioral task
behavioral1
Sample
f0204f7ea7a6d14cf24061183174987189ccdcc7091c4f6b3ba5bee07e8942e1.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f0204f7ea7a6d14cf24061183174987189ccdcc7091c4f6b3ba5bee07e8942e1.xls
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://fpd.cl/cgi-bin/83E0xgTMc/
https://el-energiaki.gr/wp-content/plugins/really-simple-ssl/testssl/serverport443/WUV5PJA/
https://www.manchesterslt.co.uk/a-to-z-of-slt/Ntrci3Ry/
http://contactworks.nl/layouts/fFxKZabh/
http://baykusoglu.com.tr/wp-admin/Y3sRBcOfZ34wg2sO/
Targets
-
-
Target
f0204f7ea7a6d14cf24061183174987189ccdcc7091c4f6b3ba5bee07e8942e1
-
Size
45KB
-
MD5
4835f3c1d2e322723a341bba9b7a92e2
-
SHA1
661508b56abc5a7886ae8f90669010ff273a620e
-
SHA256
f0204f7ea7a6d14cf24061183174987189ccdcc7091c4f6b3ba5bee07e8942e1
-
SHA512
85cc15bf34f6b795b9583156e5478b82bf9b43a373926f1470a4dfe4edc287c27c651adaba7c3cca587c898ae8011eedd9ce6052162a3435d27cfbdfcc81a937
-
SSDEEP
768:bkPKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAPVdtWgojJcFDqCRt6vuVUeJlZ:bsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dB
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-