General
-
Target
JaffaCakes118_06a7a334f5e2517c8ca43705e2a6895d
-
Size
160KB
-
Sample
250518-l8kdpaznv9
-
MD5
06a7a334f5e2517c8ca43705e2a6895d
-
SHA1
635686c6d66d68a7100331299aa18b625ef61eaa
-
SHA256
95d62fb07701b10d4125b6d637b51fb3ded4d5cac6c4c23e42afe150f0e733f8
-
SHA512
f4f6c86af4a2379c6be781a89b949509239f8e2fe27afd66a6abc0ef39f9a7775739cd49703be4ccee91e5d0c6fad634c3272b655a5702f3c8c80bee2042eaef
-
SSDEEP
3072:/iz5uTdcrrXyQBsc0vWJVi4IrwVgTnoLjIk+:q1XPIIoR
Malware Config
Extracted
http://senbiaojita.com/wp-admin/iDlsc/
http://vassanaservices.com/TEST/V3/
http://starkmotorracing.com/unhairer/nzFKm/
http://cometarabian.com/wp-includes/zFY6U/
https://buyitnowtoday.net/wp-admin/KI0K/
http://re2me.xyz/opt/Ds/
http://convictionfitness.webdmcsolutions.com/wp-admin/gUb/
Targets
-
-
Target
JaffaCakes118_06a7a334f5e2517c8ca43705e2a6895d
-
Size
160KB
-
MD5
06a7a334f5e2517c8ca43705e2a6895d
-
SHA1
635686c6d66d68a7100331299aa18b625ef61eaa
-
SHA256
95d62fb07701b10d4125b6d637b51fb3ded4d5cac6c4c23e42afe150f0e733f8
-
SHA512
f4f6c86af4a2379c6be781a89b949509239f8e2fe27afd66a6abc0ef39f9a7775739cd49703be4ccee91e5d0c6fad634c3272b655a5702f3c8c80bee2042eaef
-
SSDEEP
3072:/iz5uTdcrrXyQBsc0vWJVi4IrwVgTnoLjIk+:q1XPIIoR
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-