SecuriteInfo[.]com[.]Backdoor[.]Wisdoor[.]fr[.]30923 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Backdoor.Wisdoor.fr.30923
Size 128KB
Sample201109-g3k86hamp2
SHA256 a0c5ec02160570545c6eb2b81cbff1db49cbce0d90ba6e567b42e1a3e3a7076c
MD5 bbd1daf02824fa4c860bccc24d27cc3b
SHA1 ef4cff4bc4f0cac10c6ffe117868a13d41701bdb
SHA512 50ecead8ea88b895fe1328a2aa51db3bb3fdd249e913d53b5ca4e17259bdbba453f7712ba7db740df386e3129ae66b4d0172b6b35360c3d48b66603feda0ce40
MD5 SHA1 SHA512

Score

8^/10

macro

Malware Config

Signatures

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

resource	yara_rule
sample	office_xlm_macros

File Explorer

SecuriteInfo.com.Backdoor.Wisdoor.fr.30923

.msi 128KB

SecuriteInfo.com.Backdoor.Wisdoor.fr.30923

SHA256 a0c5ec02160570545c6eb2b81cbff1db49cbce0d90ba6e567b42e1a3e3a7076c
MD5 bbd1daf02824fa4c860bccc24d27cc3b
SHA1 ef4cff4bc4f0cac10c6ffe117868a13d41701bdb
SHA512 50ecead8ea88b895fe1328a2aa51db3bb3fdd249e913d53b5ca4e17259bdbba453f7712ba7db740df386e3129ae66b4d0172b6b35360c3d48b66603feda0ce40
MD5 SHA1 SHA512

Suspicious Office macro

Office document equipped with 4.0 macros.

macro