General

  • Target

    b1854b042e1e000cad8dc081066cec4db5ca40e0f598f91a46ae49a12d3a6270

  • Size

    95KB

  • Sample

    241120-mydc3avgpc

  • MD5

    569ddba1d2a8e3b1b2f33c175acf8c53

  • SHA1

    0d5e4e028d5b945c0f189da47e269b4449bc1394

  • SHA256

    b1854b042e1e000cad8dc081066cec4db5ca40e0f598f91a46ae49a12d3a6270

  • SHA512

    506da8126d59dc64405bba6ecc7f24856462cb09e24b32dc9dc32c2c3ffa1d62778e34d6a8c07d88120cfe48c159457207f437a734b2b050db89259f35138f77

  • SSDEEP

    1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJmPq:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgf

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://atperson.com/campusvirtual/3aAaeSKPaURF/

xlm40.dropper

https://buffetmazzi.com.br/ckfinder/i/

xlm40.dropper

http://atici.net/c/MgEC/

xlm40.dropper

http://www.birebiregitim.net/wp-includes/f/

Targets

    • Target

      b1854b042e1e000cad8dc081066cec4db5ca40e0f598f91a46ae49a12d3a6270

    • Size

      95KB

    • MD5

      569ddba1d2a8e3b1b2f33c175acf8c53

    • SHA1

      0d5e4e028d5b945c0f189da47e269b4449bc1394

    • SHA256

      b1854b042e1e000cad8dc081066cec4db5ca40e0f598f91a46ae49a12d3a6270

    • SHA512

      506da8126d59dc64405bba6ecc7f24856462cb09e24b32dc9dc32c2c3ffa1d62778e34d6a8c07d88120cfe48c159457207f437a734b2b050db89259f35138f77

    • SSDEEP

      1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJmPq:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgf

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks