General

  • Target

    ceefe85b9c76a739bf2ac0901175f3cb126c9b6e03a91d6daf4f1036f5689e86

  • Size

    96KB

  • Sample

    241120-ksanwayqdj

  • MD5

    c02a174a3ef191447c3e7c94692d807e

  • SHA1

    4e2dd3724d05ce61a5888d698138c1e66e731f10

  • SHA256

    ceefe85b9c76a739bf2ac0901175f3cb126c9b6e03a91d6daf4f1036f5689e86

  • SHA512

    f5004295c9d9e4ab433843774160142675ebe2712fa1cf8e54aecf551156edc1b302ecb2d45f8d65c59e837a3905e20f61e12e374c6dfc5a548e1d9c53007585

  • SSDEEP

    1536:7kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2HuS4hcTO97v7UYdEJmg:IKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgM

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://atperson.com/campusvirtual/EOgFGo17w/

xlm40.dropper

https://eliteturismo.com/phpmailer-old/dafdBxQONtk5Uf9dxll/

xlm40.dropper

http://atici.net/c/JDFDBMIz/

xlm40.dropper

http://domesticuif.co.za/libraries/nbnH9dpd/

Targets

    • Target

      ceefe85b9c76a739bf2ac0901175f3cb126c9b6e03a91d6daf4f1036f5689e86

    • Size

      96KB

    • MD5

      c02a174a3ef191447c3e7c94692d807e

    • SHA1

      4e2dd3724d05ce61a5888d698138c1e66e731f10

    • SHA256

      ceefe85b9c76a739bf2ac0901175f3cb126c9b6e03a91d6daf4f1036f5689e86

    • SHA512

      f5004295c9d9e4ab433843774160142675ebe2712fa1cf8e54aecf551156edc1b302ecb2d45f8d65c59e837a3905e20f61e12e374c6dfc5a548e1d9c53007585

    • SSDEEP

      1536:7kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2HuS4hcTO97v7UYdEJmg:IKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgM

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks