General

  • Target

    fabb2755ccfe19b609e98b34673e0d4677ca9b0b67d9973c95975152ddc8a4f5

  • Size

    53KB

  • Sample

    241120-cz7m7aycmg

  • MD5

    6f68ed912335eebbfc5409597dd09e7f

  • SHA1

    3a4f3ed2d85d0bd79f0a83703dfc0c0528f4a211

  • SHA256

    fabb2755ccfe19b609e98b34673e0d4677ca9b0b67d9973c95975152ddc8a4f5

  • SHA512

    108d3c952093c0769d3ff81b24669d6f9a5cc311184c352d42642ff4956cdec164639db0d2f3241f4bef04c066e9252c4c041fd64d9280d262fc53cd43b0d1b6

  • SSDEEP

    1536:BPKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+ASgNeEYL8UCc:VKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMW

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://airliftlimo.com/wp-admin/wzZ3RIsItxZsu77MFxs/

xlm40.dropper

http://demo-re-usables.inertiasoft.net/cgi-bin/AR4nYNd9xpn/

xlm40.dropper

https://justplay.asia/google/oCbyPwB8B/

Targets

    • Target

      fabb2755ccfe19b609e98b34673e0d4677ca9b0b67d9973c95975152ddc8a4f5

    • Size

      53KB

    • MD5

      6f68ed912335eebbfc5409597dd09e7f

    • SHA1

      3a4f3ed2d85d0bd79f0a83703dfc0c0528f4a211

    • SHA256

      fabb2755ccfe19b609e98b34673e0d4677ca9b0b67d9973c95975152ddc8a4f5

    • SHA512

      108d3c952093c0769d3ff81b24669d6f9a5cc311184c352d42642ff4956cdec164639db0d2f3241f4bef04c066e9252c4c041fd64d9280d262fc53cd43b0d1b6

    • SSDEEP

      1536:BPKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+ASgNeEYL8UCc:VKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMW

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks