General

  • Target

    5cd8decb65dc63c909f33d3ec42380e7770b55ff233713d6c9e701ec94895ab3

  • Size

    40KB

  • Sample

    241120-yjt8ta1gnc

  • MD5

    193bc8b61cde3226b7ebb962fd3d4f18

  • SHA1

    4879e7457d55232f5216a2f0ac5b9bc63a67697e

  • SHA256

    5cd8decb65dc63c909f33d3ec42380e7770b55ff233713d6c9e701ec94895ab3

  • SHA512

    62ca1e05d7faaa7e2ccc4091c7de10d7039a9bad572eea01a0e2810acfb0c8914cdede55377243122c592a9c19c1604d82dbbe9e2bcdf3e55212ecc13b1e2d9f

  • SSDEEP

    768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAo:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

xlm40.dropper

https://www.ingonherbal.com/application/PhEbceg4Tx/

xlm40.dropper

http://ftp.colibriconstruction.net/cc/KHieqeOsagkmlGIuXc56/

xlm40.dropper

http://commune-ariana.tn/sites/3BvaCmo/

xlm40.dropper

http://dmaicinnovations.com/Swift-5.0.2/jEtePB/

xlm40.dropper

https://drcreative.cz/images/DwThyQntyImCHk0tpba/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

Targets

    • Target

      5cd8decb65dc63c909f33d3ec42380e7770b55ff233713d6c9e701ec94895ab3

    • Size

      40KB

    • MD5

      193bc8b61cde3226b7ebb962fd3d4f18

    • SHA1

      4879e7457d55232f5216a2f0ac5b9bc63a67697e

    • SHA256

      5cd8decb65dc63c909f33d3ec42380e7770b55ff233713d6c9e701ec94895ab3

    • SHA512

      62ca1e05d7faaa7e2ccc4091c7de10d7039a9bad572eea01a0e2810acfb0c8914cdede55377243122c592a9c19c1604d82dbbe9e2bcdf3e55212ecc13b1e2d9f

    • SSDEEP

      768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAo:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks