General

  • Target

    cce2048527ffdaa3366408615084a31425bd8793e75f41d9a3a05d25f74f7396

  • Size

    95KB

  • Sample

    241120-kvxanatgqf

  • MD5

    9e52aa90f3224bba98c6df773c63b77b

  • SHA1

    4de1a1453d190025b5ac77677317c4a4fb269133

  • SHA256

    cce2048527ffdaa3366408615084a31425bd8793e75f41d9a3a05d25f74f7396

  • SHA512

    ea0a7910c7459b616e5be45eea45e35628a86f5d7ce88a0caad82047e8da5d366d6b454caf6b810ff81df4fc4f2a21dc3af44a0bd5e9b25227ea2c41df2b134c

  • SSDEEP

    1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJmMq:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgy

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://atperson.com/campusvirtual/3aAaeSKPaURF/

xlm40.dropper

https://buffetmazzi.com.br/ckfinder/i/

xlm40.dropper

http://atici.net/c/MgEC/

xlm40.dropper

http://www.birebiregitim.net/wp-includes/f/

Targets

    • Target

      cce2048527ffdaa3366408615084a31425bd8793e75f41d9a3a05d25f74f7396

    • Size

      95KB

    • MD5

      9e52aa90f3224bba98c6df773c63b77b

    • SHA1

      4de1a1453d190025b5ac77677317c4a4fb269133

    • SHA256

      cce2048527ffdaa3366408615084a31425bd8793e75f41d9a3a05d25f74f7396

    • SHA512

      ea0a7910c7459b616e5be45eea45e35628a86f5d7ce88a0caad82047e8da5d366d6b454caf6b810ff81df4fc4f2a21dc3af44a0bd5e9b25227ea2c41df2b134c

    • SSDEEP

      1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJmMq:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgy

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks