General

  • Target

    f117d42e4c0110e405f1b33682d79de79e49fcabbcaffbf4e6c6c61e4d05b329

  • Size

    94KB

  • Sample

    241120-ec26as1dkl

  • MD5

    f6ed11ea2387a05fdd656974a333afbf

  • SHA1

    b489a13b8f19bb60cda450030278ed3e0c2d1a68

  • SHA256

    f117d42e4c0110e405f1b33682d79de79e49fcabbcaffbf4e6c6c61e4d05b329

  • SHA512

    412e96a479fce0a1e9fbb84765cfbbd5590428bade4bfa2b46437785e592b0027ed930b87a5daefe411a5344241b70484d8ea7fcb9b753d49634aa983c9ce938

  • SSDEEP

    1536:JsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgSUZx6FyxC3YGbl7BgWDFsqtNhWmDJdWh:6Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgZ

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://bosny.com/aspnet_client/NGTx1FUzq/

xlm40.dropper

https://www.berekethaber.com/hatax/c7crGdejW4380ORuxqR/

xlm40.dropper

https://bulldogironworksllc.com/temp/BBh5HHpei/

Targets

    • Target

      f117d42e4c0110e405f1b33682d79de79e49fcabbcaffbf4e6c6c61e4d05b329

    • Size

      94KB

    • MD5

      f6ed11ea2387a05fdd656974a333afbf

    • SHA1

      b489a13b8f19bb60cda450030278ed3e0c2d1a68

    • SHA256

      f117d42e4c0110e405f1b33682d79de79e49fcabbcaffbf4e6c6c61e4d05b329

    • SHA512

      412e96a479fce0a1e9fbb84765cfbbd5590428bade4bfa2b46437785e592b0027ed930b87a5daefe411a5344241b70484d8ea7fcb9b753d49634aa983c9ce938

    • SSDEEP

      1536:JsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgSUZx6FyxC3YGbl7BgWDFsqtNhWmDJdWh:6Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgZ

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks