General

  • Target

    a17257a4a1a71d882ccfd9037e726639b49a70bde211c5dc647492f26d27c430

  • Size

    91KB

  • Sample

    241120-ykxeka1gqg

  • MD5

    50edf8e28a4c5f13e49b31a07ce50ab5

  • SHA1

    73dcd5bb08692eedccc64c5e42d450acb4961ea9

  • SHA256

    a17257a4a1a71d882ccfd9037e726639b49a70bde211c5dc647492f26d27c430

  • SHA512

    3c2ec56da9616f23a69ededeeb21cfc86d7e5750701a14e498e2a5e21bf99316175f90330cc0c8cad6224a9ea28a61624112b7132277c1b7a72d0e98d7024772

  • SSDEEP

    1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4ZMEM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgF

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.muyehuayi.com/cmp/8asA99KPsyA/v6lUsWbLen/

xlm40.dropper

http://concivilpa.com.py/wp-admin/i3CQu9dzDrMW/

xlm40.dropper

https://wijsneusmedia.nl/cgi-bin/kFB/

xlm40.dropper

http://www.angloextrema.com.br/assets/oEt1yYckHKlnNIq/

Targets

    • Target

      a17257a4a1a71d882ccfd9037e726639b49a70bde211c5dc647492f26d27c430

    • Size

      91KB

    • MD5

      50edf8e28a4c5f13e49b31a07ce50ab5

    • SHA1

      73dcd5bb08692eedccc64c5e42d450acb4961ea9

    • SHA256

      a17257a4a1a71d882ccfd9037e726639b49a70bde211c5dc647492f26d27c430

    • SHA512

      3c2ec56da9616f23a69ededeeb21cfc86d7e5750701a14e498e2a5e21bf99316175f90330cc0c8cad6224a9ea28a61624112b7132277c1b7a72d0e98d7024772

    • SSDEEP

      1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4ZMEM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgF

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks