General

  • Target

    51aa3204169db3c25942ad74067008279d89de64638786635e07ab4f8d20325b

  • Size

    64KB

  • Sample

    241120-rkl59sxra1

  • MD5

    2cb654dab58b844f48da1bca06589fc0

  • SHA1

    1f105020db0915011fe85d8d2b1eb24ea0b3fb7e

  • SHA256

    51aa3204169db3c25942ad74067008279d89de64638786635e07ab4f8d20325b

  • SHA512

    3ca6add8d1aa85311a18fabf7016d0874982e648838524042fffddf7fcd61854e77144a99e9459fcae2091e26da89092080737ad79cc7ca11bafc28672150510

  • SSDEEP

    1536:8URk3hbdlylKsgqopeJBWhZFGkE+cL2NdAKNzMk9B+oo1zMk9A+oos:8Mk3hbdlylKsgqopeJBWhZFGkE+cL2N0

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://87.251.86.178/pp/cc.html

Targets

    • Target

      51aa3204169db3c25942ad74067008279d89de64638786635e07ab4f8d20325b

    • Size

      64KB

    • MD5

      2cb654dab58b844f48da1bca06589fc0

    • SHA1

      1f105020db0915011fe85d8d2b1eb24ea0b3fb7e

    • SHA256

      51aa3204169db3c25942ad74067008279d89de64638786635e07ab4f8d20325b

    • SHA512

      3ca6add8d1aa85311a18fabf7016d0874982e648838524042fffddf7fcd61854e77144a99e9459fcae2091e26da89092080737ad79cc7ca11bafc28672150510

    • SSDEEP

      1536:8URk3hbdlylKsgqopeJBWhZFGkE+cL2NdAKNzMk9B+oo1zMk9A+oos:8Mk3hbdlylKsgqopeJBWhZFGkE+cL2N0

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks