General

  • Target

    9cc14758503828940e0fa1614483519772439fd9674a2ec9d7c8c1f50a1bf558

  • Size

    40KB

  • Sample

    241120-vyd9csvkfm

  • MD5

    2cc21ce374cc3f8a2c40cda84231bbda

  • SHA1

    d1f4b23d57140c6c3019dcc6588942667e80ab3b

  • SHA256

    9cc14758503828940e0fa1614483519772439fd9674a2ec9d7c8c1f50a1bf558

  • SHA512

    3fbadb27ec5c357600508faf5cdf52558d745c2143308938f4492bd8ba931b335ca5991bd611ecaf1a798a875537f54ccda2eeb4e4fbf52de7045bacfe8590cc

  • SSDEEP

    768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAo:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

xlm40.dropper

https://www.ingonherbal.com/application/PhEbceg4Tx/

xlm40.dropper

http://ftp.colibriconstruction.net/cc/KHieqeOsagkmlGIuXc56/

xlm40.dropper

http://commune-ariana.tn/sites/3BvaCmo/

xlm40.dropper

http://dmaicinnovations.com/Swift-5.0.2/jEtePB/

xlm40.dropper

https://drcreative.cz/images/DwThyQntyImCHk0tpba/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

Targets

    • Target

      9cc14758503828940e0fa1614483519772439fd9674a2ec9d7c8c1f50a1bf558

    • Size

      40KB

    • MD5

      2cc21ce374cc3f8a2c40cda84231bbda

    • SHA1

      d1f4b23d57140c6c3019dcc6588942667e80ab3b

    • SHA256

      9cc14758503828940e0fa1614483519772439fd9674a2ec9d7c8c1f50a1bf558

    • SHA512

      3fbadb27ec5c357600508faf5cdf52558d745c2143308938f4492bd8ba931b335ca5991bd611ecaf1a798a875537f54ccda2eeb4e4fbf52de7045bacfe8590cc

    • SSDEEP

      768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAo:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks