General

  • Target

    070d9fffb97de124a1ef6979c4250c1e580e854d370a1f7b626bf62f5bcfa7b9

  • Size

    95KB

  • Sample

    241120-nbne7awgkm

  • MD5

    53db7027ebe87942dab849ff3e4390b7

  • SHA1

    24c13cfe44588bec753baacc50d646b290ce2aaa

  • SHA256

    070d9fffb97de124a1ef6979c4250c1e580e854d370a1f7b626bf62f5bcfa7b9

  • SHA512

    771a99e631c603a43d36e38f199d2fd6b6318df2924b8f761de5e19a9dba664703ff8ca827ae6b71fe9682deba2a7338927e0bd48452df661c1caa9cb6729f3c

  • SSDEEP

    1536:UkKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/HuS4hcTO97v7UYdEJmEj7e:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgW

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://yakosurf.com/wp-includes/y9jgKE7f1wMM/

xlm40.dropper

https://fikti.bem.gunadarma.ac.id/SDM/xDYmcOngg/

xlm40.dropper

http://armannahalpersian.ir/armannahalpersian/byxUd7hAO2/

xlm40.dropper

http://disweb.sk/lfHCegwZndgMs/KFfG/

Targets

    • Target

      070d9fffb97de124a1ef6979c4250c1e580e854d370a1f7b626bf62f5bcfa7b9

    • Size

      95KB

    • MD5

      53db7027ebe87942dab849ff3e4390b7

    • SHA1

      24c13cfe44588bec753baacc50d646b290ce2aaa

    • SHA256

      070d9fffb97de124a1ef6979c4250c1e580e854d370a1f7b626bf62f5bcfa7b9

    • SHA512

      771a99e631c603a43d36e38f199d2fd6b6318df2924b8f761de5e19a9dba664703ff8ca827ae6b71fe9682deba2a7338927e0bd48452df661c1caa9cb6729f3c

    • SSDEEP

      1536:UkKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/HuS4hcTO97v7UYdEJmEj7e:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgW

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks