General

  • Target

    3b3e640a15a24331bb2127faf703e1b3a3998558dd750e522f0bfed04ebfc906

  • Size

    67KB

  • Sample

    241120-3dsj9awfmp

  • MD5

    aae1436e3ffedebe5c60d7b7e59465c7

  • SHA1

    ced5491af49cce42a04eabeb48ed0ac7ceae206e

  • SHA256

    3b3e640a15a24331bb2127faf703e1b3a3998558dd750e522f0bfed04ebfc906

  • SHA512

    2d0158f145fb6095058b735449ac17138ed9ef1331f339c013b28f7107f50ef216781574458e85f0b586e97d17bf29c70496127203fe50698f9729cf73e604a3

  • SSDEEP

    1536:nVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+u9s1a6YG2jzQ0viPvDNHhGtM:VKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM0

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.melisetotoaksesuar.com/catalog/controller/account/dqfKI/

xlm40.dropper

http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/

xlm40.dropper

http://masyuk.com/581voyze/MlX/

xlm40.dropper

http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/

Targets

    • Target

      3b3e640a15a24331bb2127faf703e1b3a3998558dd750e522f0bfed04ebfc906

    • Size

      67KB

    • MD5

      aae1436e3ffedebe5c60d7b7e59465c7

    • SHA1

      ced5491af49cce42a04eabeb48ed0ac7ceae206e

    • SHA256

      3b3e640a15a24331bb2127faf703e1b3a3998558dd750e522f0bfed04ebfc906

    • SHA512

      2d0158f145fb6095058b735449ac17138ed9ef1331f339c013b28f7107f50ef216781574458e85f0b586e97d17bf29c70496127203fe50698f9729cf73e604a3

    • SSDEEP

      1536:nVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+u9s1a6YG2jzQ0viPvDNHhGtM:VKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM0

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks