General

  • Target

    699b70644f54d0a8b1bd3127ef6770c6c19f0de82087ad76108a0d68055c2ba1

  • Size

    91KB

  • Sample

    241120-js4fhsvbkr

  • MD5

    d686700342ca2e512f2c0db4f2c091fe

  • SHA1

    7311c4dda1d12ec68e491ab8b62b7500c78cb778

  • SHA256

    699b70644f54d0a8b1bd3127ef6770c6c19f0de82087ad76108a0d68055c2ba1

  • SHA512

    34b30785dc117b4a1b2230f2b5af1b745c0f5ce736fc31ca84e1bcc9b24191dbbe72662196d2b328cb533e161c9a435d42a3ff469b9a125c291a97eaf1c727ee

  • SSDEEP

    1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4ZwEM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgJ

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.muyehuayi.com/cmp/8asA99KPsyA/v6lUsWbLen/

xlm40.dropper

http://concivilpa.com.py/wp-admin/i3CQu9dzDrMW/

xlm40.dropper

https://wijsneusmedia.nl/cgi-bin/kFB/

xlm40.dropper

http://www.angloextrema.com.br/assets/oEt1yYckHKlnNIq/

Targets

    • Target

      699b70644f54d0a8b1bd3127ef6770c6c19f0de82087ad76108a0d68055c2ba1

    • Size

      91KB

    • MD5

      d686700342ca2e512f2c0db4f2c091fe

    • SHA1

      7311c4dda1d12ec68e491ab8b62b7500c78cb778

    • SHA256

      699b70644f54d0a8b1bd3127ef6770c6c19f0de82087ad76108a0d68055c2ba1

    • SHA512

      34b30785dc117b4a1b2230f2b5af1b745c0f5ce736fc31ca84e1bcc9b24191dbbe72662196d2b328cb533e161c9a435d42a3ff469b9a125c291a97eaf1c727ee

    • SSDEEP

      1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4ZwEM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgJ

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks