General

  • Target

    1b64a4758ea343a9bf2f15289202813cf3f37ff3a82cad2f9988a22baf2c605d

  • Size

    40KB

  • Sample

    241120-vzearavkhm

  • MD5

    1fce97e7cd1ec66da1205bd31d5e1bd1

  • SHA1

    320294037573cf2bbfcec783b02069dc1b219ae2

  • SHA256

    1b64a4758ea343a9bf2f15289202813cf3f37ff3a82cad2f9988a22baf2c605d

  • SHA512

    56e8b95232de24593964d874f9312de6809f1483aabbab05e988bc4dbe1c8b3326960d0f6e57ebda0336c651c906157939a1447aa299c3218f95d96eedc5f1dd

  • SSDEEP

    768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1lA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/do

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://easiercommunications.com/wp-content/w/

xlm40.dropper

http://dulichdichvu.net/libraries/QhtrjCZymLp5EbqOdpKk/

xlm40.dropper

https://www.whow.fr/wp-includes/H54Fgj0tG/

xlm40.dropper

http://genccagdas.com.tr/assets/TTHOm833iNn3BxT/

xlm40.dropper

http://heaventechnologies.com.pk/apitest/xdeAU0rx26LT9I/

xlm40.dropper

http://goonboy.com/goonie/bSFz7Av/

Targets

    • Target

      1b64a4758ea343a9bf2f15289202813cf3f37ff3a82cad2f9988a22baf2c605d

    • Size

      40KB

    • MD5

      1fce97e7cd1ec66da1205bd31d5e1bd1

    • SHA1

      320294037573cf2bbfcec783b02069dc1b219ae2

    • SHA256

      1b64a4758ea343a9bf2f15289202813cf3f37ff3a82cad2f9988a22baf2c605d

    • SHA512

      56e8b95232de24593964d874f9312de6809f1483aabbab05e988bc4dbe1c8b3326960d0f6e57ebda0336c651c906157939a1447aa299c3218f95d96eedc5f1dd

    • SSDEEP

      768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1lA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/do

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks