General

  • Target

    9cb4641d9d261f888d9eecd5c23c2839f052ecb0be5393fcf22fa554d4c68c1f

  • Size

    40KB

  • Sample

    241120-vtrznazbqg

  • MD5

    7099d2e5ec3d8302c134796858fe3321

  • SHA1

    60a98aded1a95f11b40a614295906a4ae429bdb5

  • SHA256

    9cb4641d9d261f888d9eecd5c23c2839f052ecb0be5393fcf22fa554d4c68c1f

  • SHA512

    7dc58f7ac4068485cbc5ed730df828f9fddfbd38ddef9f153cdce5e7da9ea4dcc057945930d883d8df7fceb2050f969e3aab4d6b6e18938a16e33c6099b1156c

  • SSDEEP

    768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1lc:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dk

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://easiercommunications.com/wp-content/w/

xlm40.dropper

http://dulichdichvu.net/libraries/QhtrjCZymLp5EbqOdpKk/

xlm40.dropper

https://www.whow.fr/wp-includes/H54Fgj0tG/

xlm40.dropper

http://genccagdas.com.tr/assets/TTHOm833iNn3BxT/

xlm40.dropper

http://heaventechnologies.com.pk/apitest/xdeAU0rx26LT9I/

xlm40.dropper

http://goonboy.com/goonie/bSFz7Av/

Targets

    • Target

      9cb4641d9d261f888d9eecd5c23c2839f052ecb0be5393fcf22fa554d4c68c1f

    • Size

      40KB

    • MD5

      7099d2e5ec3d8302c134796858fe3321

    • SHA1

      60a98aded1a95f11b40a614295906a4ae429bdb5

    • SHA256

      9cb4641d9d261f888d9eecd5c23c2839f052ecb0be5393fcf22fa554d4c68c1f

    • SHA512

      7dc58f7ac4068485cbc5ed730df828f9fddfbd38ddef9f153cdce5e7da9ea4dcc057945930d883d8df7fceb2050f969e3aab4d6b6e18938a16e33c6099b1156c

    • SSDEEP

      768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1lc:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dk

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks