General

  • Target

    9b84bb874d73c13d886bc0ac0ebe1488bfd5359c2563779f71b6df1edd2b813e

  • Size

    40KB

  • Sample

    241121-ascs5awqgs

  • MD5

    1876eb24f74b3a7fc8d994f1adca9ea4

  • SHA1

    e5df1e1dcaa080e55cac538f3ced30a31679e602

  • SHA256

    9b84bb874d73c13d886bc0ac0ebe1488bfd5359c2563779f71b6df1edd2b813e

  • SHA512

    c777d7ae363790cc05375eaf309fe6652a6e6b38b1616a82393d42834c650c5c19f6b406ced634b4cf4b0c1c4c44d4ea47f3964fe62b794ae94db5b7c1e1e100

  • SSDEEP

    768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1lQ:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d4

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://easiercommunications.com/wp-content/w/

xlm40.dropper

http://dulichdichvu.net/libraries/QhtrjCZymLp5EbqOdpKk/

xlm40.dropper

https://www.whow.fr/wp-includes/H54Fgj0tG/

xlm40.dropper

http://genccagdas.com.tr/assets/TTHOm833iNn3BxT/

xlm40.dropper

http://heaventechnologies.com.pk/apitest/xdeAU0rx26LT9I/

xlm40.dropper

http://goonboy.com/goonie/bSFz7Av/

Targets

    • Target

      9b84bb874d73c13d886bc0ac0ebe1488bfd5359c2563779f71b6df1edd2b813e

    • Size

      40KB

    • MD5

      1876eb24f74b3a7fc8d994f1adca9ea4

    • SHA1

      e5df1e1dcaa080e55cac538f3ced30a31679e602

    • SHA256

      9b84bb874d73c13d886bc0ac0ebe1488bfd5359c2563779f71b6df1edd2b813e

    • SHA512

      c777d7ae363790cc05375eaf309fe6652a6e6b38b1616a82393d42834c650c5c19f6b406ced634b4cf4b0c1c4c44d4ea47f3964fe62b794ae94db5b7c1e1e100

    • SSDEEP

      768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1lQ:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d4

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks