Deep Malware Analysis of a87ff06ba769975cfd4706c3761f0b9a | md5: a87ff06ba769975cfd4706c3761f0b9a | Office Document | Remote Template Injection | T1221 | Moderately Suspicious Document

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	a87ff06ba769975cfd4706c3761f0b9a
Sha1	e74034edfaa4b7fd6562cdbd67007988bce7e772
Sha256	62a3447e62daf4522af0db92546a50a163f5ee55c195d65a5732b1c34a2d982f
Sha384	328578557984e6e15f0fffee6a93f5a2c753f08b4e953a2795f8824d3617addbefd6861af5c439152d59a8385c4d872c
Sha512	a5cf4fec9a0a92cfad223f7d519117dada36d23ad5fe548c35338577623ea98f79930cf35da81a56fbe9c3c6c85f9621084180fd4b0b89b2cb9fa7f9cfa43b6d
SSDeep	12288:6MYjruj30EDXv1JPee8u9G/mtcShn+7dVxNR+9sVc//y5EIj3Ii:6MYjrg30QDH8u9VzhYLRCC5Eo
TLSH	36D423E62F6C44996ED421AF5AD238FAF4118E219E37CFC92142B774F539808096F787

File Structure

Malware Configuration - Remote Template

Config. Field0	Value
Target	https:huhuhuhuhuhuhuhuhuhuhu
Path	settihuhuhuhuhuhuhu
XPath	/Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML	<Relathuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Informations

Artefacts

Name	Value
Remote Template - Highly Suspicious	https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys…) are available with Essential.

a87ff06ba769975cfd4706c3761f0b9a (643.83 KB)