General

  • Target

    1491c8cc5f111e7871a91ed3091d28a24e7a5be7a1c93cebda38460b5d90cd06

  • Size

    95KB

  • Sample

    241120-m327zswkav

  • MD5

    7c41b5fe0bdd916756dfae6d5fca5200

  • SHA1

    15d47026cefb48a73c1b625aa3c1a8a19fae598c

  • SHA256

    1491c8cc5f111e7871a91ed3091d28a24e7a5be7a1c93cebda38460b5d90cd06

  • SHA512

    6cfc0e13798e3f5de9a933769b25b95411d866e60f154e4dbaf2378b0f1b7a6eafba87676fc3f3e0392d4178a49877070f82939995b4fdd0934bde7921c590c4

  • SSDEEP

    1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg1HuS4hcTO97v7UYdEJmSCr+:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgh

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://francite.net/images/XI7zS0X1nY/

xlm40.dropper

https://cointrade.world/receipts/Sa6fYJpecEVqiRf05/

xlm40.dropper

http://gedebey-tvradio.info/wp-includes/nOmdPyUpDB/

xlm40.dropper

http://haircutbar.com/cgi-bin/SpJT9OKPmUpJfkGqv/

Targets

    • Target

      1491c8cc5f111e7871a91ed3091d28a24e7a5be7a1c93cebda38460b5d90cd06

    • Size

      95KB

    • MD5

      7c41b5fe0bdd916756dfae6d5fca5200

    • SHA1

      15d47026cefb48a73c1b625aa3c1a8a19fae598c

    • SHA256

      1491c8cc5f111e7871a91ed3091d28a24e7a5be7a1c93cebda38460b5d90cd06

    • SHA512

      6cfc0e13798e3f5de9a933769b25b95411d866e60f154e4dbaf2378b0f1b7a6eafba87676fc3f3e0392d4178a49877070f82939995b4fdd0934bde7921c590c4

    • SSDEEP

      1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg1HuS4hcTO97v7UYdEJmSCr+:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgh

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks