General

  • Target

    354b4c76d41a3876cdf8c0f1c5d42a8a43eac691fba25265a2707264e44c5460

  • Size

    76KB

  • Sample

    241121-aghv1a1lbr

  • MD5

    f7e4bba71e889f707f13fbbbb7a6d3f3

  • SHA1

    90868797062a0b6bb0e45319ff05aed3ea313949

  • SHA256

    354b4c76d41a3876cdf8c0f1c5d42a8a43eac691fba25265a2707264e44c5460

  • SHA512

    6e12728367feb9e880bb438d3ff45a92e4c561dc3b6ae30d0f42da0dca77ae32397cccfe09c4e57a01e04dc94686700c638b25348e3613698b9e54519c9f1410

  • SSDEEP

    1536:GSKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgYI+hD8nTLqQrRrZws8EKXi3C:FKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgW

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://newkano.com/wp-admin/66rIsrVwoPKUsjcAs/

xlm40.dropper

http://ocalogullari.com/inc/Wcm82enrs8/

xlm40.dropper

https://myphamcuatui.com/assets/OPVeVSpO/

Targets

    • Target

      354b4c76d41a3876cdf8c0f1c5d42a8a43eac691fba25265a2707264e44c5460

    • Size

      76KB

    • MD5

      f7e4bba71e889f707f13fbbbb7a6d3f3

    • SHA1

      90868797062a0b6bb0e45319ff05aed3ea313949

    • SHA256

      354b4c76d41a3876cdf8c0f1c5d42a8a43eac691fba25265a2707264e44c5460

    • SHA512

      6e12728367feb9e880bb438d3ff45a92e4c561dc3b6ae30d0f42da0dca77ae32397cccfe09c4e57a01e04dc94686700c638b25348e3613698b9e54519c9f1410

    • SSDEEP

      1536:GSKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgYI+hD8nTLqQrRrZws8EKXi3C:FKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgW

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks