General

  • Target

    003e2c71473d513ffd9565ec44b0aeec9fd83bbff55184eff51fdc1c4936b41b

  • Size

    63KB

  • Sample

    241120-tas7yazcjj

  • MD5

    e9f7fc42700630cbe1c704346df66c90

  • SHA1

    4a5ff93fcd060c404fe7b52948b41897446c7a2e

  • SHA256

    003e2c71473d513ffd9565ec44b0aeec9fd83bbff55184eff51fdc1c4936b41b

  • SHA512

    819663dc6975986e575c27e4fd7c0f53a74f4050e8583e8ab2b01b41889081244159ed04769c83c565cc0e3cf7ca5c77213bd3205261dfb70f76f4daf3e58d60

  • SSDEEP

    1536:dpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9HuS4VcTO9/r7UYdEJe5o1/:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgP

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.careofu.com/PHPExcel/sQ78BedribNJZbGYj/

xlm40.dropper

https://cedeco.es/js/n74fS/

xlm40.dropper

http://balticcontrolbd.com/cgi-bin/Gu0xno0kIssGJF8/

xlm40.dropper

https://fikti.bem.gunadarma.ac.id/SDM/qNeMUe2RvxdvuRlf/

Targets

    • Target

      003e2c71473d513ffd9565ec44b0aeec9fd83bbff55184eff51fdc1c4936b41b

    • Size

      63KB

    • MD5

      e9f7fc42700630cbe1c704346df66c90

    • SHA1

      4a5ff93fcd060c404fe7b52948b41897446c7a2e

    • SHA256

      003e2c71473d513ffd9565ec44b0aeec9fd83bbff55184eff51fdc1c4936b41b

    • SHA512

      819663dc6975986e575c27e4fd7c0f53a74f4050e8583e8ab2b01b41889081244159ed04769c83c565cc0e3cf7ca5c77213bd3205261dfb70f76f4daf3e58d60

    • SSDEEP

      1536:dpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9HuS4VcTO9/r7UYdEJe5o1/:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgP

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks