General

  • Target

    b36458a6bcdf273b3eb5bfdaa61600052f7d84a944c8037fa98f845872545675

  • Size

    96KB

  • Sample

    241120-qx9xesskbk

  • MD5

    bad7820b01e7a32a474d21edf5386394

  • SHA1

    375a2008df9abd782181c07cb381de5ac7605881

  • SHA256

    b36458a6bcdf273b3eb5bfdaa61600052f7d84a944c8037fa98f845872545675

  • SHA512

    1d60d48f834e9be0e135c98b22df0d845c91991739dd8b3f2269cf9b05ab2a6c7282b6312a98d7300020e266bea6659fc2d4f16fb78a658e04bf598f33c664d7

  • SSDEEP

    1536:7kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2HuS4hcTO97v7UYdEJm0:IKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgQ

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://atperson.com/campusvirtual/EOgFGo17w/

xlm40.dropper

https://eliteturismo.com/phpmailer-old/dafdBxQONtk5Uf9dxll/

xlm40.dropper

http://atici.net/c/JDFDBMIz/

xlm40.dropper

http://domesticuif.co.za/libraries/nbnH9dpd/

Targets

    • Target

      b36458a6bcdf273b3eb5bfdaa61600052f7d84a944c8037fa98f845872545675

    • Size

      96KB

    • MD5

      bad7820b01e7a32a474d21edf5386394

    • SHA1

      375a2008df9abd782181c07cb381de5ac7605881

    • SHA256

      b36458a6bcdf273b3eb5bfdaa61600052f7d84a944c8037fa98f845872545675

    • SHA512

      1d60d48f834e9be0e135c98b22df0d845c91991739dd8b3f2269cf9b05ab2a6c7282b6312a98d7300020e266bea6659fc2d4f16fb78a658e04bf598f33c664d7

    • SSDEEP

      1536:7kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2HuS4hcTO97v7UYdEJm0:IKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgQ

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks