General

  • Target

    2678f0814b9b74a56173fd87a9b9824ff7fa04ea4bd6f5c89b3d97bef97ee8d6

  • Size

    91KB

  • Sample

    241120-dafnvazclr

  • MD5

    79721a5bc7f27072ef0805803627d88d

  • SHA1

    0fe0b7d44815fb6fb06913d5985607a90e781aaa

  • SHA256

    2678f0814b9b74a56173fd87a9b9824ff7fa04ea4bd6f5c89b3d97bef97ee8d6

  • SHA512

    a5a41d92d038595447534629b1a2f358a7e064228c3396624822aa38a0dc5e8f081f0925dc9630a0a6ef22c11bf987a11db0f4c657586d4e278ed3833cf103b7

  • SSDEEP

    1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgIbCXuZH4gb4CEn9J4ZJFQvj:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://fixoutlet.com/logs/OGlRuU/

xlm40.dropper

http://www.cesasin.com.ar/administrator/viA95RR/

xlm40.dropper

http://blacktequila.com.br/2fb62HWWoKi5nfEq2D/XB5VOAXZkhVhSKveYUV/

xlm40.dropper

http://case.co.il/_js/dooigYa/

Targets

    • Target

      2678f0814b9b74a56173fd87a9b9824ff7fa04ea4bd6f5c89b3d97bef97ee8d6

    • Size

      91KB

    • MD5

      79721a5bc7f27072ef0805803627d88d

    • SHA1

      0fe0b7d44815fb6fb06913d5985607a90e781aaa

    • SHA256

      2678f0814b9b74a56173fd87a9b9824ff7fa04ea4bd6f5c89b3d97bef97ee8d6

    • SHA512

      a5a41d92d038595447534629b1a2f358a7e064228c3396624822aa38a0dc5e8f081f0925dc9630a0a6ef22c11bf987a11db0f4c657586d4e278ed3833cf103b7

    • SSDEEP

      1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgIbCXuZH4gb4CEn9J4ZJFQvj:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks