General

  • Target

    cae176e88f2d6f60a2a2b0c09d8793e95cb6da51f08cd914e7de900b1ca554e4

  • Size

    56KB

  • Sample

    241120-svqrwayhrk

  • MD5

    9f51a6bba49344b0516d50ca3c57da11

  • SHA1

    4f92141835a36d94a9f3aa4e0d28b1376e008f5e

  • SHA256

    cae176e88f2d6f60a2a2b0c09d8793e95cb6da51f08cd914e7de900b1ca554e4

  • SHA512

    a37412e0e1ba5d3a3af9f01664b28e1e5216ae11ba76b94784fa4f7dbc67f4ccc3b9b6aaafc2daf1942e23fa1f9656ca7a1ab456bf7fac1b374ce3521824f259

  • SSDEEP

    1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umv/:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgs

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://church.ktc-center.net/PbSkdCOW/

xlm40.dropper

https://chobemaster.com/components/gus/

xlm40.dropper

https://christianchapman.com/cgi-bin/gADHL9UXSFUTN/

Targets

    • Target

      cae176e88f2d6f60a2a2b0c09d8793e95cb6da51f08cd914e7de900b1ca554e4

    • Size

      56KB

    • MD5

      9f51a6bba49344b0516d50ca3c57da11

    • SHA1

      4f92141835a36d94a9f3aa4e0d28b1376e008f5e

    • SHA256

      cae176e88f2d6f60a2a2b0c09d8793e95cb6da51f08cd914e7de900b1ca554e4

    • SHA512

      a37412e0e1ba5d3a3af9f01664b28e1e5216ae11ba76b94784fa4f7dbc67f4ccc3b9b6aaafc2daf1942e23fa1f9656ca7a1ab456bf7fac1b374ce3521824f259

    • SSDEEP

      1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umv/:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgs

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks