General

  • Target

    b9fd23efb7ba41c3d2b8d7047a74cf9f94899f77cd3cbae124b4d0e0b93ada4e

  • Size

    95KB

  • Sample

    241120-26zzcswekm

  • MD5

    b7c8f4b666da9232b8a1af602f8eab37

  • SHA1

    b57ce08cbefcb92abd6017a661c93605fa49e0be

  • SHA256

    b9fd23efb7ba41c3d2b8d7047a74cf9f94899f77cd3cbae124b4d0e0b93ada4e

  • SHA512

    a74382c93fbc9ec0e2d59618363d5eb244815b18fd8bd4ca068df6da703238d736d3d99a26277fd5215b14028907bed3a3eb58dbec309b8ccafc541b0a07c4c0

  • SSDEEP

    1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJmAq:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg+

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://atperson.com/campusvirtual/3aAaeSKPaURF/

xlm40.dropper

https://buffetmazzi.com.br/ckfinder/i/

xlm40.dropper

http://atici.net/c/MgEC/

xlm40.dropper

http://www.birebiregitim.net/wp-includes/f/

Targets

    • Target

      b9fd23efb7ba41c3d2b8d7047a74cf9f94899f77cd3cbae124b4d0e0b93ada4e

    • Size

      95KB

    • MD5

      b7c8f4b666da9232b8a1af602f8eab37

    • SHA1

      b57ce08cbefcb92abd6017a661c93605fa49e0be

    • SHA256

      b9fd23efb7ba41c3d2b8d7047a74cf9f94899f77cd3cbae124b4d0e0b93ada4e

    • SHA512

      a74382c93fbc9ec0e2d59618363d5eb244815b18fd8bd4ca068df6da703238d736d3d99a26277fd5215b14028907bed3a3eb58dbec309b8ccafc541b0a07c4c0

    • SSDEEP

      1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJmAq:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg+

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks