General
-
Target
ac6e3aaa1362c0d90a2f8579ece2bb2f8c3ed2cedef0a86bee2be24d1326944c
-
Size
45KB
-
Sample
241120-z4a64stlfy
-
MD5
22f178981be291f958252d6cb08e2114
-
SHA1
6dea36cf90c21d32bffd6c050abba896f3e87f7f
-
SHA256
ac6e3aaa1362c0d90a2f8579ece2bb2f8c3ed2cedef0a86bee2be24d1326944c
-
SHA512
e7b4ca1570ae8021b0d2957328ca3969c81127200daa0b69ff6d58e7f8ead5bacd38672bcbf7fb635bc3857660a754016864af9d1c2ea4f58b76e76ef4f12822
-
SSDEEP
768:bkPKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAPVdtWgojJcFDqCRt6vuVUeJlZ:bsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dB
Behavioral task
behavioral1
Sample
ac6e3aaa1362c0d90a2f8579ece2bb2f8c3ed2cedef0a86bee2be24d1326944c.xls
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ac6e3aaa1362c0d90a2f8579ece2bb2f8c3ed2cedef0a86bee2be24d1326944c.xls
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://fpd.cl/cgi-bin/83E0xgTMc/
https://el-energiaki.gr/wp-content/plugins/really-simple-ssl/testssl/serverport443/WUV5PJA/
https://www.manchesterslt.co.uk/a-to-z-of-slt/Ntrci3Ry/
http://contactworks.nl/layouts/fFxKZabh/
http://baykusoglu.com.tr/wp-admin/Y3sRBcOfZ34wg2sO/
Targets
-
-
Target
ac6e3aaa1362c0d90a2f8579ece2bb2f8c3ed2cedef0a86bee2be24d1326944c
-
Size
45KB
-
MD5
22f178981be291f958252d6cb08e2114
-
SHA1
6dea36cf90c21d32bffd6c050abba896f3e87f7f
-
SHA256
ac6e3aaa1362c0d90a2f8579ece2bb2f8c3ed2cedef0a86bee2be24d1326944c
-
SHA512
e7b4ca1570ae8021b0d2957328ca3969c81127200daa0b69ff6d58e7f8ead5bacd38672bcbf7fb635bc3857660a754016864af9d1c2ea4f58b76e76ef4f12822
-
SSDEEP
768:bkPKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAPVdtWgojJcFDqCRt6vuVUeJlZ:bsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dB
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-