General

  • Target

    51dfb767ab7055cf3b2102bf3be58fa4036f5f8a2aa6687db9f8a5e1b7f72be7

  • Size

    70KB

  • Sample

    241120-vpw3tavjfm

  • MD5

    0529fe302eace166e9a4f22b23f38d6b

  • SHA1

    c989873673c6038fc3668b732d0f7a3c7ef1132c

  • SHA256

    51dfb767ab7055cf3b2102bf3be58fa4036f5f8a2aa6687db9f8a5e1b7f72be7

  • SHA512

    cad5c8bdf622bff1741d7bd70784163924513e36a183ffbbecdfc0ef5dbe57fede20acc33db3868c1c98404110d360de53ff0e3956b9008b2cea410ae5e7ac40

  • SSDEEP

    1536:OhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+/+hDcnTLiQrRTZws8E7K:uKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMF

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://prprofile.com/wp-admin/CIqrvgYsvBiBlIM/

xlm40.dropper

https://retardantedefuegoperu.com/slider/rFhAa78/

xlm40.dropper

http://survei.absensi.net/cc-content/YCcjkOA3ijYNu46Y/

Targets

    • Target

      51dfb767ab7055cf3b2102bf3be58fa4036f5f8a2aa6687db9f8a5e1b7f72be7

    • Size

      70KB

    • MD5

      0529fe302eace166e9a4f22b23f38d6b

    • SHA1

      c989873673c6038fc3668b732d0f7a3c7ef1132c

    • SHA256

      51dfb767ab7055cf3b2102bf3be58fa4036f5f8a2aa6687db9f8a5e1b7f72be7

    • SHA512

      cad5c8bdf622bff1741d7bd70784163924513e36a183ffbbecdfc0ef5dbe57fede20acc33db3868c1c98404110d360de53ff0e3956b9008b2cea410ae5e7ac40

    • SSDEEP

      1536:OhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+/+hDcnTLiQrRTZws8E7K:uKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMF

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks