General

  • Target

    2caf39a890a5a3bec7439d61c22ced217ea31c1cf48af27147b32df299328d5b

  • Size

    53KB

  • Sample

    241120-qypmwaxbrh

  • MD5

    7b9d82afdd4458e03b470277215eb904

  • SHA1

    ddff2bba025272ee4df2cf3717adb2882b1cea93

  • SHA256

    2caf39a890a5a3bec7439d61c22ced217ea31c1cf48af27147b32df299328d5b

  • SHA512

    6569a3a94ea174afe319b4817db7007b1b9beb6e9b725eb3fe14178cf422a99b492c9a806383f3a82a800d5f287aee097b0f786443fc181afd3d47c506050c01

  • SSDEEP

    1536:BPKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+ASgNeEYL8UCU:VKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMe

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://airliftlimo.com/wp-admin/wzZ3RIsItxZsu77MFxs/

xlm40.dropper

http://demo-re-usables.inertiasoft.net/cgi-bin/AR4nYNd9xpn/

xlm40.dropper

https://justplay.asia/google/oCbyPwB8B/

Targets

    • Target

      2caf39a890a5a3bec7439d61c22ced217ea31c1cf48af27147b32df299328d5b

    • Size

      53KB

    • MD5

      7b9d82afdd4458e03b470277215eb904

    • SHA1

      ddff2bba025272ee4df2cf3717adb2882b1cea93

    • SHA256

      2caf39a890a5a3bec7439d61c22ced217ea31c1cf48af27147b32df299328d5b

    • SHA512

      6569a3a94ea174afe319b4817db7007b1b9beb6e9b725eb3fe14178cf422a99b492c9a806383f3a82a800d5f287aee097b0f786443fc181afd3d47c506050c01

    • SSDEEP

      1536:BPKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+ASgNeEYL8UCU:VKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMe

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks