General

  • Target

    ea67bd5aa759ced842a120b2678493bc4a9eaa0a8b0c1ff56f334d29cf20c2cf

  • Size

    95KB

  • Sample

    241120-l6tjkswbrm

  • MD5

    94e49c97a4ec32bd4bbda7c065c9f6f3

  • SHA1

    6a53ce26477972b94e380541176d41d7b2460ed3

  • SHA256

    ea67bd5aa759ced842a120b2678493bc4a9eaa0a8b0c1ff56f334d29cf20c2cf

  • SHA512

    92d793e1b1737c861de01989fce913ce28e28c908c30ab616fc07bc164d526fbd18ee2bfe555958dcdaa6d7dc9dc183fcd692658b3bf34a61f8f787b94a3b1a8

  • SSDEEP

    1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgYHuS4hcTO97v7UYdEJmFB2:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgk

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://educacionsanvicentefundacion.com/iplookup/wYEInbaN/

xlm40.dropper

https://www.4monkeys.com/wp-admin/dNAuBEKo/

xlm40.dropper

http://haircutbar.com/cgi-bin/dNfEA5F/

xlm40.dropper

http://gedebey-tvradio.info/wp-includes/T0J9THbd5f2/

Targets

    • Target

      ea67bd5aa759ced842a120b2678493bc4a9eaa0a8b0c1ff56f334d29cf20c2cf

    • Size

      95KB

    • MD5

      94e49c97a4ec32bd4bbda7c065c9f6f3

    • SHA1

      6a53ce26477972b94e380541176d41d7b2460ed3

    • SHA256

      ea67bd5aa759ced842a120b2678493bc4a9eaa0a8b0c1ff56f334d29cf20c2cf

    • SHA512

      92d793e1b1737c861de01989fce913ce28e28c908c30ab616fc07bc164d526fbd18ee2bfe555958dcdaa6d7dc9dc183fcd692658b3bf34a61f8f787b94a3b1a8

    • SSDEEP

      1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgYHuS4hcTO97v7UYdEJmFB2:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgk

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks