General

  • Target

    cbb58c8ec4847f0a43bf61a2e3dee71a9cc6e3f13f19a9faaac52e1c70d81258

  • Size

    40KB

  • Sample

    241120-2zjzkawdjn

  • MD5

    55363fa1314c9c44cc6446a20ece8585

  • SHA1

    f950881e3ed1d3539cbc5ec2cdeda601c5b29df5

  • SHA256

    cbb58c8ec4847f0a43bf61a2e3dee71a9cc6e3f13f19a9faaac52e1c70d81258

  • SHA512

    70d7df995965375c801cc1181c832cf0d7b52f731f69214a4ebaad9f6fb1cc2a1dddd04bba9b575c0778735a9e652e249dce7290f0d45bd5898d63c78fe37979

  • SSDEEP

    768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1lA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/do

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://easiercommunications.com/wp-content/w/

xlm40.dropper

http://dulichdichvu.net/libraries/QhtrjCZymLp5EbqOdpKk/

xlm40.dropper

https://www.whow.fr/wp-includes/H54Fgj0tG/

xlm40.dropper

http://genccagdas.com.tr/assets/TTHOm833iNn3BxT/

xlm40.dropper

http://heaventechnologies.com.pk/apitest/xdeAU0rx26LT9I/

xlm40.dropper

http://goonboy.com/goonie/bSFz7Av/

Targets

    • Target

      cbb58c8ec4847f0a43bf61a2e3dee71a9cc6e3f13f19a9faaac52e1c70d81258

    • Size

      40KB

    • MD5

      55363fa1314c9c44cc6446a20ece8585

    • SHA1

      f950881e3ed1d3539cbc5ec2cdeda601c5b29df5

    • SHA256

      cbb58c8ec4847f0a43bf61a2e3dee71a9cc6e3f13f19a9faaac52e1c70d81258

    • SHA512

      70d7df995965375c801cc1181c832cf0d7b52f731f69214a4ebaad9f6fb1cc2a1dddd04bba9b575c0778735a9e652e249dce7290f0d45bd5898d63c78fe37979

    • SSDEEP

      768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1lA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/do

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks