General

  • Target

    61604f0c5807e98f4b10a9a20a70703339c77907bfdd7ad7fb9bf41bb4788936

  • Size

    95KB

  • Sample

    241120-s9eyxszbqj

  • MD5

    22325fb8bd19234e9c2b60d952ebe55c

  • SHA1

    c55c5eec13cc8a84be7a670c9daccfc5ebf03280

  • SHA256

    61604f0c5807e98f4b10a9a20a70703339c77907bfdd7ad7fb9bf41bb4788936

  • SHA512

    e4ec624fcb31de4ba382c3194c9d9c183b5e9492114c36bfe743a83eddc770dd9822d24b62949217ed93235185f62834d6fc5155d1f9b21ef4cd7a2b5a05ce32

  • SSDEEP

    1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJm8q:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgC

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://atperson.com/campusvirtual/3aAaeSKPaURF/

xlm40.dropper

https://buffetmazzi.com.br/ckfinder/i/

xlm40.dropper

http://atici.net/c/MgEC/

xlm40.dropper

http://www.birebiregitim.net/wp-includes/f/

Targets

    • Target

      61604f0c5807e98f4b10a9a20a70703339c77907bfdd7ad7fb9bf41bb4788936

    • Size

      95KB

    • MD5

      22325fb8bd19234e9c2b60d952ebe55c

    • SHA1

      c55c5eec13cc8a84be7a670c9daccfc5ebf03280

    • SHA256

      61604f0c5807e98f4b10a9a20a70703339c77907bfdd7ad7fb9bf41bb4788936

    • SHA512

      e4ec624fcb31de4ba382c3194c9d9c183b5e9492114c36bfe743a83eddc770dd9822d24b62949217ed93235185f62834d6fc5155d1f9b21ef4cd7a2b5a05ce32

    • SSDEEP

      1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJm8q:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgC

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks