Managed XDR

autorecovery-save-of-alzaabi.asd (Meterpreter) — malware analysis report

File info

Filename
autorecovery-save-of-alzaabi.asd
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Nov 6 17:02:00 2025, Number of Pages: 1, Number of Words: 5, Number of Characters: 35, Security: 0
File size
21.5 KB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
210cb5dd53f66bbbac7b70a8f9beb664f43342e1
SHA256
0cd0e4575585696f32c96baff67cf9fef869c3a38092e4a12edcf6125c68d794
MD5
18ce3a7a777dcb4abfcec29f3a89bac1

Malwares

  • Meterpreter

Signatures

Execution

T1204.002 office_com_load: Microsoft Office loads COM DLL files (indicator of COM usage in macros)

Defense Evasion

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents

Credential Access

T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Discovery

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents

Other

yara_rules: Static rules
test_check_service: Starts services
writes_data: Writes big amount of data to disk

Related reports