General

  • Target

    cdfe18c6456567861c57f1b8f78a9b2dc1c5f16c459ccac095593e7ff6dcffc8

  • Size

    95KB

  • Sample

    241120-afz3wswkb1

  • MD5

    ef9947eb74073dcda9239f456849cb1c

  • SHA1

    d894bab04cb68283d55a3e2591afce87529853a7

  • SHA256

    cdfe18c6456567861c57f1b8f78a9b2dc1c5f16c459ccac095593e7ff6dcffc8

  • SHA512

    7088ef5a78e055e34dbb422e82f037c6e108480ca79e8d654b29aa6669bcc0c7f3439aba4ce41ac7fb7822c3a671b132a1d1947d24f23da75a252bc27302accc

  • SSDEEP

    1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJmcq:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgi

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://atperson.com/campusvirtual/3aAaeSKPaURF/

xlm40.dropper

https://buffetmazzi.com.br/ckfinder/i/

xlm40.dropper

http://atici.net/c/MgEC/

xlm40.dropper

http://www.birebiregitim.net/wp-includes/f/

Targets

    • Target

      cdfe18c6456567861c57f1b8f78a9b2dc1c5f16c459ccac095593e7ff6dcffc8

    • Size

      95KB

    • MD5

      ef9947eb74073dcda9239f456849cb1c

    • SHA1

      d894bab04cb68283d55a3e2591afce87529853a7

    • SHA256

      cdfe18c6456567861c57f1b8f78a9b2dc1c5f16c459ccac095593e7ff6dcffc8

    • SHA512

      7088ef5a78e055e34dbb422e82f037c6e108480ca79e8d654b29aa6669bcc0c7f3439aba4ce41ac7fb7822c3a671b132a1d1947d24f23da75a252bc27302accc

    • SSDEEP

      1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJmcq:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgi

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks