General

  • Target

    14a0721e469731908e6f4b27e7f7b477185500a6f663537e117c21b76322f6af

  • Size

    40KB

  • Sample

    241120-dbfp8stnej

  • MD5

    58fe4288b9d7cbe602b52c3ffc8f65c0

  • SHA1

    3b680a91ae573752ed873583921a47617e2fac1e

  • SHA256

    14a0721e469731908e6f4b27e7f7b477185500a6f663537e117c21b76322f6af

  • SHA512

    76b6fad39efbeceba55c2abfe8b70e5cae15c4d4ad6a12fb5826c716869c53f5c72ed93f882842756e7d10d46892464aecc2fa82dbdf3462209620831015130d

  • SSDEEP

    768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

xlm40.dropper

https://www.ingonherbal.com/application/PhEbceg4Tx/

xlm40.dropper

http://ftp.colibriconstruction.net/cc/KHieqeOsagkmlGIuXc56/

xlm40.dropper

http://commune-ariana.tn/sites/3BvaCmo/

xlm40.dropper

http://dmaicinnovations.com/Swift-5.0.2/jEtePB/

xlm40.dropper

https://drcreative.cz/images/DwThyQntyImCHk0tpba/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

Targets

    • Target

      14a0721e469731908e6f4b27e7f7b477185500a6f663537e117c21b76322f6af

    • Size

      40KB

    • MD5

      58fe4288b9d7cbe602b52c3ffc8f65c0

    • SHA1

      3b680a91ae573752ed873583921a47617e2fac1e

    • SHA256

      14a0721e469731908e6f4b27e7f7b477185500a6f663537e117c21b76322f6af

    • SHA512

      76b6fad39efbeceba55c2abfe8b70e5cae15c4d4ad6a12fb5826c716869c53f5c72ed93f882842756e7d10d46892464aecc2fa82dbdf3462209620831015130d

    • SSDEEP

      768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks