General
-
Target
0f9f54936c277ed089c3e693ecc1cb229745b07364400b8247815c888a09cf9b
-
Size
173KB
-
Sample
241120-zc7e8ssdng
-
MD5
5241dd964d853c1c46b4806a6a5199c8
-
SHA1
66f8e49163a8b17d9727b45205bbd6c43771eeaf
-
SHA256
0f9f54936c277ed089c3e693ecc1cb229745b07364400b8247815c888a09cf9b
-
SHA512
201752e0dee9f4bcb3b14ef29e6b75c2696bb4d07ff93234ee36c5f509927a039a2e25af1337d94f6e1ca9ad47bb8cb18ed92b7390efc1dbd930ad4fb3d4933a
-
SSDEEP
3072:ss2y/Gdy/ktGDWLS0HZWD5w8K7Nk9pD7IBUSWzB31U3h:ss2k4PtGiL3HJk9pD7bdd31k
Malware Config
Extracted
http://staging.mcuinternational.org/tmp/zmrx/
https://35g8.com/defines/5etmq2/
https://namdeinvest.com/wp-content/hxjzb/
http://ibtinfracon.com/wp/WNr/
http://websitetest.dranubhasingh.com/wp-includes/7j8/
Targets
-
-
Target
0f9f54936c277ed089c3e693ecc1cb229745b07364400b8247815c888a09cf9b
-
Size
173KB
-
MD5
5241dd964d853c1c46b4806a6a5199c8
-
SHA1
66f8e49163a8b17d9727b45205bbd6c43771eeaf
-
SHA256
0f9f54936c277ed089c3e693ecc1cb229745b07364400b8247815c888a09cf9b
-
SHA512
201752e0dee9f4bcb3b14ef29e6b75c2696bb4d07ff93234ee36c5f509927a039a2e25af1337d94f6e1ca9ad47bb8cb18ed92b7390efc1dbd930ad4fb3d4933a
-
SSDEEP
3072:ss2y/Gdy/ktGDWLS0HZWD5w8K7Nk9pD7IBUSWzB31U3h:ss2k4PtGiL3HJk9pD7bdd31k
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Drops file in System32 directory
-