General

  • Target

    d1fb043984f9672efa7274627a788d0712fce3dc723e59b20bff44dcc41040f4

  • Size

    40KB

  • Sample

    241120-acdeqawje1

  • MD5

    9f1357eef36373b327aa12e2199fdff1

  • SHA1

    7f5a41af7f82eb6bb517b35280c6010d5d814fd0

  • SHA256

    d1fb043984f9672efa7274627a788d0712fce3dc723e59b20bff44dcc41040f4

  • SHA512

    6011759a31dc05514c26386e81752b459a7f67cc3e7e611ef5f69e9d20c49f4e058345ff1a6c8c5f8e5a6f66cdd5b18fadffd73df368dc905858a2d120a011ec

  • SSDEEP

    768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAo:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

xlm40.dropper

https://www.ingonherbal.com/application/PhEbceg4Tx/

xlm40.dropper

http://ftp.colibriconstruction.net/cc/KHieqeOsagkmlGIuXc56/

xlm40.dropper

http://commune-ariana.tn/sites/3BvaCmo/

xlm40.dropper

http://dmaicinnovations.com/Swift-5.0.2/jEtePB/

xlm40.dropper

https://drcreative.cz/images/DwThyQntyImCHk0tpba/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

Targets

    • Target

      d1fb043984f9672efa7274627a788d0712fce3dc723e59b20bff44dcc41040f4

    • Size

      40KB

    • MD5

      9f1357eef36373b327aa12e2199fdff1

    • SHA1

      7f5a41af7f82eb6bb517b35280c6010d5d814fd0

    • SHA256

      d1fb043984f9672efa7274627a788d0712fce3dc723e59b20bff44dcc41040f4

    • SHA512

      6011759a31dc05514c26386e81752b459a7f67cc3e7e611ef5f69e9d20c49f4e058345ff1a6c8c5f8e5a6f66cdd5b18fadffd73df368dc905858a2d120a011ec

    • SSDEEP

      768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAo:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks