General

  • Target

    2ea5bc2c60693749e0bd2230d9acd4ef42aaa2cc25373f224e14bdd269bfabb2

  • Size

    248KB

  • Sample

    241120-ej4mpszpfy

  • MD5

    68b8a9f3b2bfff6c8c44dff61bfabe12

  • SHA1

    35c4a6ea64553a1a4a1b86ce60c8880384f48965

  • SHA256

    2ea5bc2c60693749e0bd2230d9acd4ef42aaa2cc25373f224e14bdd269bfabb2

  • SHA512

    e610ab50726f79f090d3340a2a51b2fcdc962b49a2ec34caca46cabd3af8162528dd6a43cc12fed20e23db31cb23d4c3966cb280127f42f8e299b4146a42a45d

  • SSDEEP

    6144:EKpbdrHYrMue8q7QPX+5xtFEdi8/dgUThvsiKIjvl5fd1Xh8rsoX/w/05:UhEXs5fXR8rsNU

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://dalgahavuzu.com/pwkfky/LF0WU/

xlm40.dropper

https://dolphinsupremehavuzrobotu.com/yrrct/QcbxhqCQ/

xlm40.dropper

https://sandiegoinsuranceagents.com/cgi-bin/XK1VSXZddLdN/

xlm40.dropper

https://kinetekturk.com/e2ea69p/9U52O7jTobF8J/

xlm40.dropper

https://isguvenligiburada.com/xcg/uZSU/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://dalgahavuzu.com/pwkfky/LF0WU/

xlm40.dropper

https://dolphinsupremehavuzrobotu.com/yrrct/QcbxhqCQ/

xlm40.dropper

https://sandiegoinsuranceagents.com/cgi-bin/XK1VSXZddLdN/

Targets

    • Target

      2ea5bc2c60693749e0bd2230d9acd4ef42aaa2cc25373f224e14bdd269bfabb2

    • Size

      248KB

    • MD5

      68b8a9f3b2bfff6c8c44dff61bfabe12

    • SHA1

      35c4a6ea64553a1a4a1b86ce60c8880384f48965

    • SHA256

      2ea5bc2c60693749e0bd2230d9acd4ef42aaa2cc25373f224e14bdd269bfabb2

    • SHA512

      e610ab50726f79f090d3340a2a51b2fcdc962b49a2ec34caca46cabd3af8162528dd6a43cc12fed20e23db31cb23d4c3966cb280127f42f8e299b4146a42a45d

    • SSDEEP

      6144:EKpbdrHYrMue8q7QPX+5xtFEdi8/dgUThvsiKIjvl5fd1Xh8rsoX/w/05:UhEXs5fXR8rsNU

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks