General

  • Target

    cb59c1f3b6d8f404ca9ca6f855b42c3517eb7ac7ae6a770e0db179a6bd46117f

  • Size

    95KB

  • Sample

    241120-n9ekya1ldq

  • MD5

    939a571dbf83188ab7feb64568f9ae45

  • SHA1

    e449a2ea390a9985fda50461102de5f1c5710f2c

  • SHA256

    cb59c1f3b6d8f404ca9ca6f855b42c3517eb7ac7ae6a770e0db179a6bd46117f

  • SHA512

    0fe66baca1c4eb9d5d21caf48d7c9b7bb28ef00e9ea20a6deaade2fcf4e48a94ad88d23a17a596cb7b32e1357e3585c70441aae84679111afd22ea6d6cbf9cf0

  • SSDEEP

    1536:PFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgPHuS4hcTO97v7UYdEJmXNHE:tKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgN

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://aysbody.com/catalog/Oax5/

xlm40.dropper

http://www.garantihaliyikama.com/wp-admin/QVvdNIasGj/

xlm40.dropper

https://yoymanajemen.id/wp-content/khXBxIm5/

xlm40.dropper

https://dawtona.dev.goldensystem.pl/wp-admin/EX05554XhKk3ee2cQ/

Targets

    • Target

      cb59c1f3b6d8f404ca9ca6f855b42c3517eb7ac7ae6a770e0db179a6bd46117f

    • Size

      95KB

    • MD5

      939a571dbf83188ab7feb64568f9ae45

    • SHA1

      e449a2ea390a9985fda50461102de5f1c5710f2c

    • SHA256

      cb59c1f3b6d8f404ca9ca6f855b42c3517eb7ac7ae6a770e0db179a6bd46117f

    • SHA512

      0fe66baca1c4eb9d5d21caf48d7c9b7bb28ef00e9ea20a6deaade2fcf4e48a94ad88d23a17a596cb7b32e1357e3585c70441aae84679111afd22ea6d6cbf9cf0

    • SSDEEP

      1536:PFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgPHuS4hcTO97v7UYdEJmXNHE:tKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgN

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks