General

  • Target

    78afb3547e7e9f424414d46a6d95d52a6c793b27350128496ebf08051e967b4b

  • Size

    95KB

  • Sample

    241120-qlf5za1req

  • MD5

    76eb433a1a6a62f20abb19e1915a35b2

  • SHA1

    230a64ad9f23226faccda6c4999679c67de61d4f

  • SHA256

    78afb3547e7e9f424414d46a6d95d52a6c793b27350128496ebf08051e967b4b

  • SHA512

    563315c0938b20dda482b048a40d620d44c49c114e0dc8e2705fdb195f19219230fa99e4888cf9ed304dea029f90af603cfd231d268b2fd982c58d9c48d62cfa

  • SSDEEP

    1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJmgq:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dge

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://atperson.com/campusvirtual/3aAaeSKPaURF/

xlm40.dropper

https://buffetmazzi.com.br/ckfinder/i/

xlm40.dropper

http://atici.net/c/MgEC/

xlm40.dropper

http://www.birebiregitim.net/wp-includes/f/

Targets

    • Target

      78afb3547e7e9f424414d46a6d95d52a6c793b27350128496ebf08051e967b4b

    • Size

      95KB

    • MD5

      76eb433a1a6a62f20abb19e1915a35b2

    • SHA1

      230a64ad9f23226faccda6c4999679c67de61d4f

    • SHA256

      78afb3547e7e9f424414d46a6d95d52a6c793b27350128496ebf08051e967b4b

    • SHA512

      563315c0938b20dda482b048a40d620d44c49c114e0dc8e2705fdb195f19219230fa99e4888cf9ed304dea029f90af603cfd231d268b2fd982c58d9c48d62cfa

    • SSDEEP

      1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJmgq:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dge

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks