General

  • Target

    5a7c15c2bde2f7b4d7a9230d4b626ba90b707cb0e610e39c7a5c0c303584b47d

  • Size

    63KB

  • Sample

    241120-pj7pgaxcnq

  • MD5

    e77368603ea39c64ce8c28349b84d0fe

  • SHA1

    e4f567d31c35d2f892f1d14ccadb2809e82fc44b

  • SHA256

    5a7c15c2bde2f7b4d7a9230d4b626ba90b707cb0e610e39c7a5c0c303584b47d

  • SHA512

    0d00ec81ec68a30e63c63e677d99efb79e03610317b7286a73fe1348cc0e41b86006a00475ba731e14295172cbeeb641bbd35ce012fb618e3d80e45ceb0168c5

  • SSDEEP

    1536:dpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9HuS4VcTO9/r7UYdEJe5o1/:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgP

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.careofu.com/PHPExcel/sQ78BedribNJZbGYj/

xlm40.dropper

https://cedeco.es/js/n74fS/

xlm40.dropper

http://balticcontrolbd.com/cgi-bin/Gu0xno0kIssGJF8/

xlm40.dropper

https://fikti.bem.gunadarma.ac.id/SDM/qNeMUe2RvxdvuRlf/

Targets

    • Target

      5a7c15c2bde2f7b4d7a9230d4b626ba90b707cb0e610e39c7a5c0c303584b47d

    • Size

      63KB

    • MD5

      e77368603ea39c64ce8c28349b84d0fe

    • SHA1

      e4f567d31c35d2f892f1d14ccadb2809e82fc44b

    • SHA256

      5a7c15c2bde2f7b4d7a9230d4b626ba90b707cb0e610e39c7a5c0c303584b47d

    • SHA512

      0d00ec81ec68a30e63c63e677d99efb79e03610317b7286a73fe1348cc0e41b86006a00475ba731e14295172cbeeb641bbd35ce012fb618e3d80e45ceb0168c5

    • SSDEEP

      1536:dpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9HuS4VcTO9/r7UYdEJe5o1/:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgP

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks