General

  • Target

    f207369855d07b05f4830e00ccb718410bd2c7edd9c09f4f5476ce9bd8751e9b

  • Size

    60KB

  • Sample

    241120-t8er7szfrn

  • MD5

    5223896eb12943ec037d11195ca5ed58

  • SHA1

    37f15acbd5a769c500e28ea7eaac45514da68d9d

  • SHA256

    f207369855d07b05f4830e00ccb718410bd2c7edd9c09f4f5476ce9bd8751e9b

  • SHA512

    f65ed69d2f8b8cc1b6137d0e7db565ef5de521af7cf660afa407a8f24a830803c91ec1b8544b40a1f88c72830d006e458d6deee00ba0cb50c13bebb94001b55b

  • SSDEEP

    1536:NpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgUDOJiA6Cv/UGLI36yOAR5N:rKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgo

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.valyval.com/pun/VAYL/

xlm40.dropper

http://cabans.com/CeudWYRQEzZgrHPcI/

xlm40.dropper

http://calzadoyuyin.com/cgj-bin/jZPff/

xlm40.dropper

http://cagranus.com/slide/mcqAFuMhaekn/

Targets

    • Target

      f207369855d07b05f4830e00ccb718410bd2c7edd9c09f4f5476ce9bd8751e9b

    • Size

      60KB

    • MD5

      5223896eb12943ec037d11195ca5ed58

    • SHA1

      37f15acbd5a769c500e28ea7eaac45514da68d9d

    • SHA256

      f207369855d07b05f4830e00ccb718410bd2c7edd9c09f4f5476ce9bd8751e9b

    • SHA512

      f65ed69d2f8b8cc1b6137d0e7db565ef5de521af7cf660afa407a8f24a830803c91ec1b8544b40a1f88c72830d006e458d6deee00ba0cb50c13bebb94001b55b

    • SSDEEP

      1536:NpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgUDOJiA6Cv/UGLI36yOAR5N:rKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgo

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks