General
-
Target
9e39f5019aa1188800dc78f670cc48a5c01bc6a745e8a65f2fde90ad8fcac180
-
Size
196KB
-
Sample
241120-nrtbda1jhj
-
MD5
1fcaf9750600ffdd3db96fb282c9c713
-
SHA1
7e4e1faa682bb6948f5fa38e988bee2d2cb88e4d
-
SHA256
9e39f5019aa1188800dc78f670cc48a5c01bc6a745e8a65f2fde90ad8fcac180
-
SHA512
6a5523dab1c4ac52e4436318fc9bd3bbf6f23c20c35f36012fcd000cbba7b540a16788d3d5ee430b5b77632d203420b871c8281fc8935b37918b241176aff94b
-
SSDEEP
3072:0d2y/GdynktGDWLS0HZWD5w8K7Nk98D7IBUnawiVQdwHcL:0d2k43tGiL3HJk98D7bnZ2QqI
Malware Config
Extracted
https://salvacodina.com/wp-admin/qWYFrK/
http://serviska.com/show_cat3/lKzElbNb/
https://bar-ola.com/wp-admin/KIdh35kENT/
http://rinani.com/wp-includes/FFkV/
https://wowmotions.com/wp-admin/A8LwzwQ/
Targets
-
-
Target
9e39f5019aa1188800dc78f670cc48a5c01bc6a745e8a65f2fde90ad8fcac180
-
Size
196KB
-
MD5
1fcaf9750600ffdd3db96fb282c9c713
-
SHA1
7e4e1faa682bb6948f5fa38e988bee2d2cb88e4d
-
SHA256
9e39f5019aa1188800dc78f670cc48a5c01bc6a745e8a65f2fde90ad8fcac180
-
SHA512
6a5523dab1c4ac52e4436318fc9bd3bbf6f23c20c35f36012fcd000cbba7b540a16788d3d5ee430b5b77632d203420b871c8281fc8935b37918b241176aff94b
-
SSDEEP
3072:0d2y/GdynktGDWLS0HZWD5w8K7Nk98D7IBUnawiVQdwHcL:0d2k43tGiL3HJk98D7bnZ2QqI
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Drops file in System32 directory
-