General
-
Target
b0225b8155b48e748206bd1d51dcf8ef239900726cddf604dc04aff4079502e8
-
Size
63KB
-
Sample
241120-nsq8eawnaz
-
MD5
9f9395689992bce448582cb2571d70f0
-
SHA1
93bc4d1adc82b4610318e14172a2a82988a6d02b
-
SHA256
b0225b8155b48e748206bd1d51dcf8ef239900726cddf604dc04aff4079502e8
-
SHA512
1d25d9e9d142d3dfe57b6a829bb5bf0b375a076954f3b48519f80da9f85ea70acaff236b0bf5aabdc8b8adb844c4c8149f7f863307180bf03cc6d0ba7034c304
-
SSDEEP
1536:dpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9HuS4VcTO9/r7UYdEJe5ot/:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgn
Behavioral task
behavioral1
Sample
b0225b8155b48e748206bd1d51dcf8ef239900726cddf604dc04aff4079502e8.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b0225b8155b48e748206bd1d51dcf8ef239900726cddf604dc04aff4079502e8.xls
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://www.careofu.com/PHPExcel/sQ78BedribNJZbGYj/
https://cedeco.es/js/n74fS/
http://balticcontrolbd.com/cgi-bin/Gu0xno0kIssGJF8/
https://fikti.bem.gunadarma.ac.id/SDM/qNeMUe2RvxdvuRlf/
Targets
-
-
Target
b0225b8155b48e748206bd1d51dcf8ef239900726cddf604dc04aff4079502e8
-
Size
63KB
-
MD5
9f9395689992bce448582cb2571d70f0
-
SHA1
93bc4d1adc82b4610318e14172a2a82988a6d02b
-
SHA256
b0225b8155b48e748206bd1d51dcf8ef239900726cddf604dc04aff4079502e8
-
SHA512
1d25d9e9d142d3dfe57b6a829bb5bf0b375a076954f3b48519f80da9f85ea70acaff236b0bf5aabdc8b8adb844c4c8149f7f863307180bf03cc6d0ba7034c304
-
SSDEEP
1536:dpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9HuS4VcTO9/r7UYdEJe5ot/:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgn
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-