General

  • Target

    f0204f7ea7a6d14cf24061183174987189ccdcc7091c4f6b3ba5bee07e8942e1

  • Size

    45KB

  • Sample

    241120-221ebsvqd1

  • MD5

    4835f3c1d2e322723a341bba9b7a92e2

  • SHA1

    661508b56abc5a7886ae8f90669010ff273a620e

  • SHA256

    f0204f7ea7a6d14cf24061183174987189ccdcc7091c4f6b3ba5bee07e8942e1

  • SHA512

    85cc15bf34f6b795b9583156e5478b82bf9b43a373926f1470a4dfe4edc287c27c651adaba7c3cca587c898ae8011eedd9ce6052162a3435d27cfbdfcc81a937

  • SSDEEP

    768:bkPKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAPVdtWgojJcFDqCRt6vuVUeJlZ:bsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dB

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://fpd.cl/cgi-bin/83E0xgTMc/

xlm40.dropper

https://el-energiaki.gr/wp-content/plugins/really-simple-ssl/testssl/serverport443/WUV5PJA/

xlm40.dropper

https://www.manchesterslt.co.uk/a-to-z-of-slt/Ntrci3Ry/

xlm40.dropper

http://contactworks.nl/layouts/fFxKZabh/

xlm40.dropper

http://baykusoglu.com.tr/wp-admin/Y3sRBcOfZ34wg2sO/

Targets

    • Target

      f0204f7ea7a6d14cf24061183174987189ccdcc7091c4f6b3ba5bee07e8942e1

    • Size

      45KB

    • MD5

      4835f3c1d2e322723a341bba9b7a92e2

    • SHA1

      661508b56abc5a7886ae8f90669010ff273a620e

    • SHA256

      f0204f7ea7a6d14cf24061183174987189ccdcc7091c4f6b3ba5bee07e8942e1

    • SHA512

      85cc15bf34f6b795b9583156e5478b82bf9b43a373926f1470a4dfe4edc287c27c651adaba7c3cca587c898ae8011eedd9ce6052162a3435d27cfbdfcc81a937

    • SSDEEP

      768:bkPKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAPVdtWgojJcFDqCRt6vuVUeJlZ:bsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dB

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks