General

  • Target

    a230ad5ca2567b174c97fc9d38e23cae4e243a2df847daa1d2290024c480cdc8

  • Size

    95KB

  • Sample

    241121-anerxswphy

  • MD5

    f2d0109c32bca89c212d650d4760bf17

  • SHA1

    7c636757a786500b1c04695980eb81f374c34d16

  • SHA256

    a230ad5ca2567b174c97fc9d38e23cae4e243a2df847daa1d2290024c480cdc8

  • SHA512

    35070dc3015dddd92c420c77735946a57535c303054698686dd92193e200d22e9bcc0aa5d4a12aa561d2dce99e91096379996239e002144e95674a04cb98a5e5

  • SSDEEP

    1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgYHuS4hcTO97v7UYdEJmFB2:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgk

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://educacionsanvicentefundacion.com/iplookup/wYEInbaN/

xlm40.dropper

https://www.4monkeys.com/wp-admin/dNAuBEKo/

xlm40.dropper

http://haircutbar.com/cgi-bin/dNfEA5F/

xlm40.dropper

http://gedebey-tvradio.info/wp-includes/T0J9THbd5f2/

Targets

    • Target

      a230ad5ca2567b174c97fc9d38e23cae4e243a2df847daa1d2290024c480cdc8

    • Size

      95KB

    • MD5

      f2d0109c32bca89c212d650d4760bf17

    • SHA1

      7c636757a786500b1c04695980eb81f374c34d16

    • SHA256

      a230ad5ca2567b174c97fc9d38e23cae4e243a2df847daa1d2290024c480cdc8

    • SHA512

      35070dc3015dddd92c420c77735946a57535c303054698686dd92193e200d22e9bcc0aa5d4a12aa561d2dce99e91096379996239e002144e95674a04cb98a5e5

    • SSDEEP

      1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgYHuS4hcTO97v7UYdEJmFB2:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgk

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks